“The attacker doesn’t need to be anywhere near you - they can track your location from thousands of miles away as long as there are Apple devices passing near you.”
Malware without root can make any Bluetooth device broadcast as an AirTag. Over 1.5 billion iPhones then report its location to Apple. Accuracy reaches 3 meters indoors for about $2 of GPU time. Apple patched it, but only iPhones that install the update stop relaying.