That is not true. All locations are encrypted with a public key before being uploaded to Apple's servers, and only the user's devices (which contain the private key) can decrypt the location.