The reason that Goodreads or any 3rd-party service asks for access to your address book is to find other friends/contacts that use the same service.
Using basic authentication, people would just provide their username and password to the service (say their Gmail account) and the service would read the address book. This is a highly insecure practice and is teaching people to be phished.
The new method that Goodreads is using is OAuth or OAuth 2.0 which provide granular access to your accounts via a token, and allows access to be revoked. In theory this is better, in practice a nefarious user can get that password in a hundred ways.
Once Goodreads has access to your contact info, you have to trust them that they won't do anything dodgy with it, like spam your entire address book (Plaxo, I'm looking at you!). If you're not comfortable with this, don't grant access to them.