> They still need bluetooth permissions, which is going to be sus for your average flashlight/weather/game app.

Looking at the apps I had to purge from family members' phones, I don't think that will be a problem.

> If the app already has location permissions, why would they need to pull off this attack? They get the user's location directly.

Accessing geolocation APIs will show an indicator and add an entry to a log (at least on Android). I don't believe accessing BLE APIs do the same.