Honestly, all malware "isn't really that bad" by the metrics you're using. Maybe it sends spam. Maybe it hogs your CPU. A few will crash your machine or break it in some obvious way. This one happened to steal your personal data (and attempt to steal that of your contacts').
You're right though, that it's basically exposing a hole in the OS security metaphor. Two really: the address book was unprotected and the application review process didn't work.