I'm not sure as to what Apple could even do here. Make AccuWeather disclose this and be honest with its users in the app description? When we give away location information to any app, that information may go anywhere. It's probably a matter of luck that this particular app was sending it to a third party site directly and was "caught", but other apps may as well be sending it to their own servers, which in turn send them to many data brokers and ad targeters. We wouldn't know anything for the rest of them.

This seems like a complex problem to me, and it seems like the solutions cannot be technical alone. We would need to push for better policies and laws too.