Last time I checked, the real time tracking was disabled by default and could only be enabled only for specially selected contacts, but it's been a while since I checked.

And if someone shows off their expensive bikes on social media (and that's what Strava is, among other functions)... well, it makes it known to others that they own expensive bikes. Social media has been around for long enough that its users should be aware that this kind of behaviour may impose certain risks.