Can confirm, also on 2024111800. Paired phone with a 2022 Toyota Corolla, did not grant permission to share contacts in initial pair dialogue (default was off, did not touch toggle). The car subsequently sent further permission requests to access contacts (and to be fair I switched away to another app as they came through, but did not grant these).
Checked today and all contacts have been uploaded to the car (which has remote connectivity to Toyota so may have leaked my entire private address book to the manufacturer!). In GrapheneOS Bluetooth Settings the toggle for allowing contact and message access is on for the "CAR MULTIMEDIA" device. This is a major privacy bug.
If you manually disable the toggle in phone Bluetooth settings after pairing, forget the device on the car, then re-pair, the toggle stays disabled. However I cannot think of a way to do the initial pair without leaking your entire address book.