The main point here is that they're doing the tracking with a typical user mode application without access to anything that a user would know is giving away their location.

Tracking location with other sensors requires more permissions.