My (probably incomplete) understanding is: phones have a GNSS chip (such as GPS, Galileo, or Glonass), but getting location from that takes a long time and a lot of battery. So they estimate location based on other information such as what cell tower they are connected to and the list of available wi-fi networks. This requires a database with all that info, which Google built through its Street View cars.

So the location provider is a service to which your phone sends all the info it has and which replies with an estimate of your location; which means it handles a lot of sensitive data.

Nah, open street maps is part of an open source map initiative with Meta and Microsoft, we're safe there....