It should be clear to anyone here that the moment to act on this is before your contacts get copied, not trying to get them un-copied later. Think of it as a betrayal of your contacts, that you sell them out (then ponder the likelihood that none of yours have done the same, it's probably infinitesimal.)
Ironic, I know, but that's what it has come to. Welcome to 2020.
In the vast majority of cases I just don't need to call most people. I mostly stick between instant messaging and (during pandemic) video calls and (non-pandemic) in-person meetings and just avoid the awkward middle ground of audio-but-no-video phone calls.
The os would just pretend those contacts don't exist when all contacts are requested. There could be a checkbox to share protected contacts on the permissions prompt in case you're trying to actually export them.
GDPR is a good example of a law that the US sheepishly somehow chooses to obey EU law (wtf, why didn't the US obey the EU laws around recycling and energy and no free plastic grocery bags for the past decade? and all of a sudden they care about obeying GDPR?), but do Central/South American, African, Middle Eastern, and Asian countries take a crap about GDPR? Generally not. They don't care about EU law. It doesn't apply in their jurisdiction, and they are not sheep. That isn't to say privacy doesn't matter, it's just that the law needs to be locally implemented, not obeying some arbitrary EU interpretation of the idea that wasn't even discussed with them.
As such, I think technical approaches are generally superior to regulatory approaches in user protection. They apply across the entire world instantly.
Fundamentally, that's not a thing in the long term. Trust lasts until the next bad quarter if you're lucky, because ultimately a company will choose to abuse your trust rather than go under.
I don't want to come down too hard on companies here, they exist to make money, that's what they're for (and plenty of them provide very useful services).
But the concept of trust doesn't make a lot of sense here. The people that make up a company aren't constant, and if you do find a company with trustworthy employees, they won't take your data with them when they leave, they will leave it for the next person to abuse.
Trusting a company beyond what they explicitly promise (anything in a EULA-like document that says they can change things at any time doesn't count) is setting yourself up to be screwed down the road.
Off topic but: am I the only one who thinks video calls are awkward and the old-timey audio-only ones are preferable? I have a disdain for people walking down the street with their phone in an outstretched hand, having inane hour long conversations while virtual bunny ears, cat whiskers or horse heads adorn their faces. Not everyone wants to put on a performance every time they speak to you. Sometimes I just want to call and say hello without having to think about whether the shirt I'm wearing is cool.
I'm used to real life where you talk and see people, and the people you see are the people who can hear and talk to you.
With phone calls the existence of people around me that can hear half the conversation, aren't part of the conversation, and can't reply to the conversation, is utterly jarring and unnatural to me and I avoid it at all costs. I can't for the life of me answer the phone and be at ease when there is anyone else in the room.
I also find it really hard to comprehend everything someone is saying without body language. That is also super unnatural to me. I read faces a lot. I'm just used to real life I guess.