It sounds like you're touching on two important points.

 First, many people struggle with the technical setup for secure, no-KYC Bitcoin usage, like using a second phone with a Custom ROM for Vexl.

 This does require effort, but it's becoming increasingly relevant, especially in certain countries. 

Second, Vexl should be more cautious when requesting access to users' contact lists—perhaps adding a clear warning or delay before such requests to ensure privacy is prioritized.