Is it normal for WhatsApp to access iPhone contacts without me using it?

Not unusual for WhatsApp. You are still able to block it from accessing your Contacts. WhatsApp is owned by FaceBook and is basically a data collection company to gather as much information about you to increase their profits by targeting ads. That is their sole revenue stream. Users have reported battery drain issues and increased data usage with the app installed even while it is not active on the screen. You would need to force close the app to stop this behavior.

It sounds like you protect your passwords, so you should not worry about being hacked. As long as the device is not jailbroken or managed by MDM (Mobile Device Management) used in school and work environments, then no one other than you is able to control your device. You also should not worry about using iCloud to back up your data. All of the information is encrypted and you are the only person that has the key. Even Apple is not able to decrypt your files or view your password. For reference, here is some reading material on the lengths Apple goes through to protect your information.

Services security overview - Apple Support

To summarize, the security on your device is solid. The weak link is the user, who can give out their passwords to anyone. By avoiding the phishing emails and the scams that everyone sees on the internet, you will eliminate the number 1 reason why people get into trouble with their accounts. Protect your Passwords and you will be fine!

Just to add to what Mac Jim pointed out regarding WhatsApp / Facebook / Meta...

You are not their customer. You are the product they sell.

The Photos app will analyze photos in the background for face detection, object detection, text detection, and for finding duplicates. If a face is detected and it is from a person in your contacts I would expect it to be noted there.

The system will periodically poll your mail server for new emails and if one is received, the email address will be compared to see if it is a person in your contacts. That is why it would show the contact name on the email if one is listed instead of just the email address.

The point remains the same, you can be assured that Apple is not gathering your contact information to sell to advertisers.

I understand your concern. The privacy report is a good tool for what data your apps are using on your device, but provides no information where you could conclude that your iPhone is being hacked. There is nothing stopping an app from sending your contact information to a third party after you have given it permission to access it. I don't consider this a hack, since you have given the app permission to use your data. If I do see an App in the privacy report that is using my information at the rate you are seeing, it would make me think twice if I really need to be giving that app permission to use my data.

On the other hand, Apple does use the data for many purposes that make using your device easier. Apple is transparent and includes itself in the privacy report, but the reasons for using your data are different than what another app would need your data for. This Support Article helps explain the privacy report and how Apple uses the data, such as Contacts, in other parts of the system.

About App Privacy Report - Apple Support

If you are concerned about hacking, you should check out the Safety Report. This is geared more to who may be logged into your account and who you may be sharing data with. You can also use it to change your password, which is the most important thing you can do to prevent hacking. Most of the hacking that is done is through phishing email and messages where a user mistakenly gives someone their password. Once a third party has your password, they can view all your photos in iCloud, have access to your email, messages, and even lock you out of your device.

How Safety Check on iPhone works to keep you safe - Apple Support

To avoid these phishing attempts, it is a good idea to review this article:

Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support

If you have done all that, you should not need to worry about your device being hacked. What permission you give the apps you download is a different matter and the privacy report you used is the tool to determine if the app is living up to what it claims to be using your data for. In the example you posted, I would be concerned about why WhatsApp is so interested in my Contacts. I think the reason I gave is accurate and what you do with the information given by the Privacy Report is up to you. It does not mean your device is being hacked. It could mean the app is using your data a lot more than what you thought when you gave it permission to do so.

Sadly true. I have found that Paramount Plus pretty much spends all their time on user content and tracking websites and every single social media site including several I have never used, some I’ve deleted before I got paramount plus and any that are openly collecting data that I don’t share but they are still getting. I’m so frustrated with being told I have control over my data while I’m looking at 300 things I don’t want and can’t change or control. 🤬

Yes.

You agreed to it by downloading the app.