But what happens when they end up stealing it from Waze, or Tile, or Apple. What happens when google just sells it to people?

Indeed.

To stop this from being a thing, it needs to be done from the ground up with a privacy respecting OS run by a privacy respecting company, serviced by a privacy respecting server.

Same as it ever was.