Short of kernel bugs, there aren't really reliable ways of getting a user's location without having the permissions.

No, I mean they don't have any permissions at all - not that they're turned off. Also I'm reasonably confident in iOS's privacy settings when it comes to apps.