And in some respects, it's far more practical for a company to adopt commonsense policies of not sharing locations publicly by default in war zones than for everyone active in that area to audit all their staff's smartphones; possibly the military have the resources and responsibility to do this but aid agencies don't.

(it's also very much in their interests not to have "delete Strava" as the first recommendation given to anyone starting a sensitive job)