How is it any different than an app that makes an request to their services API, thereby getting IP address which in itself can be used to get location information?
There is always a vector for abuse, and I think Apple has taken large steps to reduce that. I find this story a bit of a non-event.
IP gives you a rough location (like which city at best), SSID/BSSID can give you street/building level accuracy if it's in a database like https://wigle.net
Considering the scale of these apps, I'm guessing they have internal wifi<->location databases with fairly great accuracy.
Wi-Fi positioning is usually accurate within a few meters; my IP is frequently on the other side of the globe (when using a VPN or just roaming globally).
There is always a vector for abuse, and I think Apple has taken large steps to reduce that. I find this story a bit of a non-event.