That’s true. It works well when I use it. I guess it’s supplementing with the data it gets from the NWS.
I’m sure most people turn it off if they notice the location indicator in the corner is persistent, or when iOS notifies them that an app is using their location in the background for an extended period.
iOS has fine permission controls. Each API needs to be user authenticated before becoming available to any app, first or third-party. You can enable or revoke any API permission in settings under privacy.