You can leak location data through many was.

Time zone on phone, ip address of your phone, latency of your connection through a VPN (can guess your metro area based on VPN end point and your overall latency), language localization settings (if you have Malay and English then your more likely in Malaysia), advertiser ID, phone ID. If one app has location services (like tinder) and they sell your phones location and phone identifiers to third party services, like advertisement networks, then they know roughly where you are.

If a APP has your phone number, for identity verification, or two factor authentication, they can use data brokers to get your location from cell phone providers... Which is why giving ANYONE your real phone number is dangerous.

Location services are notoriously hard to fully shut down... Can't let ANY apps see wifi networks, bluetooth networks, GPS, or raw IP information, cellular data.

Even if your doing everything right, ALWAYS on VPN, GrapheneOS, no extra permissions for any apps... it takes just one mistake, to get associated with location... Turned off always on VPN to login to a captive portal, and some app (like tinder) got a few packets through outside the VPN....