But, one of the "app" toggles is labelled "System Services" which apparently only disables some system services. I would expect that disable all system service/location functionality (while leaving me the option to enable some other single app).

For my use case, namely limiting access to 3rd party apps, this mostly works. But, the toggles could be named better.