The location of the train comes from trackside sensors and is available as a free API. It doesn't give actual lat/lon – it only shows when it went past a particular checkpoint. The part that needs location permission is the one that works out which train you are on. It doesn't use that to produce the main map, it's just to work out which train you are likely to be on.