Just to clarify, it’s not just that there’s an Android API to ask for permissions that apps use to show a consistent UI: that’s the way that apps actually get access to whatever feature they’re requesting, and if they don’t go through that API they don’t get access. An app can’t just decide in an update that it wants access to contacts without asking. The Android API to get contact info checks the app requesting the info and won’t give it anything if the user hasn’t explicitly granted that permission to that app. Most commonly when something like this comes up it’s a permission that was granted in the set of permissions requested when the app was installed and the user just skipped through the prompt and they don’t realize they granted access to contacts.
For the curious, here’s the Android developer guide page that describes how Contacts permissions work for app authors. And the page describing permissions in general, how to request, etc.
Edit to add: You can go into the settings for the app (not in the app itself, but in the app manager under your device settings, usually also accessible by holding on the app’s launcher icon and going to Info) and you can remove permissions that you’ve granted previously. So if you’re worried about this you can yank the Contacts permissions at the OS level and it doesn’t matter what the Discord settings are, they won’t be able to access your contacts anymore.
I have two steam accounts, and I was not able to see anything related to a game marked private from my second account except when family sharing was enabled between the accounts. With family sharing on I could see all private games from my primary account on my secondary (including games which were not installed on the local system).
If you have family sharing on, hold off. Otherwise as far as I know it works as intended.