You are giving it to them. That's why the demo asks for your location permission, and that's why the API expects location info.
"You" here means another app that integrates their API (or you as an individual using the demo on their website). How the other app gets it is up to the other app - ideally it also just queries it directly and requires location permission.
Not sure how you came to that conclusion. An empty train would still exist in the live train data. It does not depend on mobile phones, but on rail signals and other such tracking built into the rail infrastructure.
"You" here means another app that integrates their API (or you as an individual using the demo on their website). How the other app gets it is up to the other app - ideally it also just queries it directly and requires location permission.