Didn't Android have a feature at some point where you could opt to supply it with a fake location? Maybe that was 'hacked' Android phones.

Either way, Android (and iOS) should be stricter about these things; apps should work without any permissions. I mean a navigation app without location access won't work very well and permission can be denied by accident, but that can be resolved.