I’m not sure this is entirely true. The hack was reported to have exploited a flaw in the View As feature to retrieve user access tokens. With an access token, a user can view their own location history. This isn’t internal-only data, but it is supposed to be private to the user.