If this concerns you and you must use WhatsApp, I highly suggest installing it on a separate device only used for WhatsApp, that doesn't have any contacts besides the ones in WhatsApp, which should only have a name and phone number, and registering it with a burner SIM, or from a virtual service.
An additional layer of security would be installing it in a Work profile in Android (maybe the new profiles feature works for this, I'm not sure), and only activating that profile when you need to use it.
With the recent news about the Facebook and Instagram tracking via WebRTC[1], we can only assume that they're doing it with WhatsApp as well.
I wish it was possible to give contacts permission the same way one can share photos.
Apps should not have free access to all contacts but anything else is currently highly impractical to the point of being unusable. (Android work profile is a good idea, unfortunately that profile is usually take up by… work)
An additional layer of security would be installing it in a Work profile in Android (maybe the new profiles feature works for this, I'm not sure), and only activating that profile when you need to use it.
With the recent news about the Facebook and Instagram tracking via WebRTC[1], we can only assume that they're doing it with WhatsApp as well.
[1]: https://news.ycombinator.com/item?id=44169115