The tl;dr is that you can either share this data by accident through some sort of "locate my family" app, or because your abuser gets access to your Google/Apple account (for instance because you're signed in on another device they have access to).
The threat model here can be: domestic abuse victim flees a situation at home in a hurry, stays signed in on a computer. Abuser uses the sign-in on that computer to track their phone, figures out they're staying at their aunt's place.
Yes, you can avoid this on a regular Google phone as well, but that requires correctly configuring it (and a lot, such as location and search history, can be re-enabled remotely!). If you're running Graphene you are protected by default, rather than compromised by default.
The tl;dr is that you can either share this data by accident through some sort of "locate my family" app, or because your abuser gets access to your Google/Apple account (for instance because you're signed in on another device they have access to).
The threat model here can be: domestic abuse victim flees a situation at home in a hurry, stays signed in on a computer. Abuser uses the sign-in on that computer to track their phone, figures out they're staying at their aunt's place.
Yes, you can avoid this on a regular Google phone as well, but that requires correctly configuring it (and a lot, such as location and search history, can be re-enabled remotely!). If you're running Graphene you are protected by default, rather than compromised by default.