It basically operates like dead drops. Airtags broadcast their location using a public key that constantly rotates. Apple maintains a mapping of public key to location. Anyone can look up the location of a public key, but the search space is so big that it's not worth bruteforcing. Even if you did, all you'd end up is a heatmap[1] of airtags, not very helpful. However, if you know the corresponding secret, you can predict what the public key will be and know the exact whereabouts of a particular device.
https://xkcd.com/1138/