You are giving it to them. That's why the demo asks for your location permission, and that's why the API expects location info.
"You" here means another app that integrates their API (or you as an individual using the demo on their website). How the other app gets it is up to the other app - ideally it also just queries it directly and requires location permission.
Not sure how you came to that conclusion. An empty train would still exist in the live train data. It does not depend on mobile phones, but on rail signals and other such tracking built into the rail infrastructure.
The location of the train comes from trackside sensors and is available as a free API. It doesn't give actual lat/lon – it only shows when it went past a particular checkpoint. The part that needs location permission is the one that works out which train you are on. It doesn't use that to produce the main map, it's just to work out which train you are likely to be on.
This is matching your phone's location to the already public train data.