Even worse, it exposes the city all viewers within the HTML, even if the country code is only displayed on the webpage.

Obviously, the server gets your IP when you connect but ideally it doesn't share that with all visitors. This isn't as bad as that, still concerning.