Didn't Android have a feature at some point where you could opt to supply it with a fake location? Maybe that was 'hacked' Android phones.
Either way, Android (and iOS) should be stricter about these things; apps should work without any permissions. I mean a navigation app without location access won't work very well and permission can be denied by accident, but that can be resolved.
Pair the roomba with home assistant and you wont need the app at least for day to day activities. Home Assistant is more responsible because its talking direct to the device IP address instead of using cloud retrocombulators.
Either way, Android (and iOS) should be stricter about these things; apps should work without any permissions. I mean a navigation app without location access won't work very well and permission can be denied by accident, but that can be resolved.