Of course it does and can deny it - isn't a user forced to grant the permission when installing the app? IMHO Google is to stop abuses like this on the Android OS level by means of allowing users to deny any particular permission an app demands and still install the app, encouraging users to grant/deny every particular permission consciously and forcing the app authors to handle denial of any particular permission gr…
E.g. if I use whatsapp for 3 people out of my 100 contacts saved in my phone, I want to be able to give to whatsapp only the access to the phones of these 3 contacts. Others should be invisible for whatsapp, if I want so.
And they should not get the addresses, birth dates and my notices about even these 3 contacts. They should not be able to see them, unless I explicitly want to allow.
I know, users are lazy, but at least the fine grained control and white-listing should be an option. Now it's all or nothing.