The apps that power this sort of tracking are private entities which I’m sure check very low bar compliance checkboxes but have very little practical security or privacy engineering behind them.
They are absolutely abused by black hat resellers of this access to a broader audience for profit, and I would bet a large sum of money that there is more than a few groups who have infiltrated these companies simply to retain the ability to query this data for their own (nefarious) means like kidnapping/ransom/blackmail.