They’re spying on you. Since you already give them access to your location, they can use that to find other devices around, pinpoint your location with even more accuracy, and spy on your friends.
Contacts and camera permissions irk me as well. I’d like to give you access to my contacts so I can invite a friend or something, but the app uses the permission to upload all my contacts to their server. Same with photos. Cool, you now have every picture I’ve ever taken.
This industry has an integrity problem. Programmers who write code like this should not be allowed to practice.