"However, Hiya cannot send spam calls to voicemail without having your entire contact list on its servers. The app claims it needs contact access to avoid accidentally blocking people. As Nomorobo can do this without your contacts, this feels…sneaky."

Maybe this is incorrect or changed? It's possible they're just doing the comparison for neighborhood spoofing locally too.