A recent update to the Android app somehow bypasses the need for granting the contacts permission to sign in via Google. How was this done?
We migrated over from using an older version of the Google Sign In SDK to the newest version. That's it.
In the past, we used to ask for the permission which would let us access the Android OS's logged in account's Google account. We no longer use this, and instead rely entirely on the Google Sign In SDK. It's not a bypass, it's just that the new SDK doesn't require us to have or ask for that extra permission.
Here is some more info on Google Sign In, if you're interested: https://developers.google.com/identity/