Every time I hear about the seeing through walls hacks, I wonder why the developer just doesn't send the other users locations unless it should be visible.

Maybe because doing the math to figure out if it should be visible is handled completely on the frontend to keep latency low?

This is the equivalent of a bank API giving you everyone's information, and the frontend SPA filtering it to only the logged in user.