They didn't forget. [1] String READ_CONTACTS Allows an application to read the user's contacts data. String WRITE_CONTACTS Allows an application to wri

They didn't forget. [1] String READ_CONTACTS Allows an application to read the user's contacts data. String WRITE_CONTACTS Allows an application to write (but not read) the user's contacts data. So yes, if they HAD forgotten, then Android would have the same security hole. But it doesn't, because they took security seriously. [1] http://developer.android.com/reference/android/Manifest.permission.html http://developer.android.com/reference/android/Manifest.perm...