And/or users handing over consent for the app (and included ad-tech) to use GPS data without thinking through/caring enough about the consequences. Additionally, predatory apps that demand certain permissions to work can function to force the user to give up GPS data.
Maybe after the user declines a permission and the app prompts again, there should be a checkbox on the permissions prompt that makes Android pretend the permission was granted and just spoofs the relevant data.
That still means that you're safe if you don't use those apps. I just checked, none of the apps on my phone have location services always on, apps such as Facebook have it set to never. And I can't remember Facebook ever bothering me with it (as long as I don't post something at least).
