Geolocation data isn’t authenticated or in any way secured against spoofing, so this isn’t a security hole. And it’s frequently wrong anyway (I am not now, nor have I ever been, in Ashburn, VA), so using it as the sole authority for “where are you?” and not providing a manual option is simply a bug; sloppy UX at best.