Exactly right. And you don't have to be a system app to access this information. Any app with sufficient permissions granted explicitly by a user can access these data (no root needed), and it may have legitimate reasons for doing it.