They can still add more locations later.

I would prefer if Google moved in the direction of giving apps fake permissions. Otherwise the scammers will just move onto another layer.