Sounds like a feature of the Comcast app. the best place to get an answer would be Comcast, or perhaps someone here who uses the same app can help. Here's what I can guess from what little I know.
A quick look at XFINITY Connect (the app I'm guessing your using) shows that it has both the ability to import and export to the Contacts app. At least that's what it seems to say in the description on the App Store. At some point you, or your friend, tapped on something that said 'go ahead and do this" or it's a default opt-in setting you missed.
When you entered you Comcast password in the app on your friend's iPad, you basically gave that app the permissions it needed.
If you need to use another person's device or computer to access your email or other services it's best to do so through a web browser. When doing so, make sure you do not check any boxes that say Remember Me when logging on, and log out of the site when finished. If the feature is available (and it is in Settings Safari) and the site will work with it, turning on Private Browsing is also a good idea.