One question: On Android, when I disable access to location for a specific app, does the library have a way to access the location anyway? My belief is that no, that it can't do that, but I may be wrong.

What if library "A" is included in a background app with access to location services, it then locally broadcasts via UDP or listens on a TCP port for incoming local connections, so that a library "B" can either listen to those UDP broadcasts or connects to the local TCP port of library "A" to receive the location data. Is this a possible scenario? Is Android monitoring such a behavior?