Your contacts are also likely available through your contacts' own contact lists, and wherever those have been exported.
Many apps and websites have long either openly or covertly imported contact lists. This is a common avenue for spam, phishing, and robocall / deepfakes attacks.
Individual experiences will vary greatly depending on whether or not your own contacts or those of an associate have been recently harvested or are being actively utilised.
I've long adopted the policy of not using platform contacts tools for my own contacts (flatfiles and mutt are my general preference). It's a downside risk of increased legibility.
