This is separate from A-GPS. Google seems to be using WiFi rather than Bluetooth, but the broader point remains the same. No one is stopping any vendor from crowdsourcing the location of every BT device… which is what Apple has done, for Airtags which don’t have the battery capacity to run a GPS chip.

Sure without GPS it wouldn’t be very effective to rely on only nearby devices to guess the current location. But an attacker only has to get lucky once to get your home address. So the only safe approach is to hide nearby devices/networks from unauthorized apps.