Especially if you're a multi-billion dollar conglomerate. They can't exactly claim ignorance like a start-up might.
If the police present a warrant, yes. Everything else is customer service.
Option 2: don't comply with LE+owner's request; deal with later warrant at higher cost (now you have compliance & legal involved); vehicle is not recovered, bad PR is obtained, and everyone loses.
Consequence 1b: you released tracking information to a stalker. They fooled your rep into thinking police were involved. Not only do you have a PR nightmare, you've also opened yourself up to legal liability.
I'm not arguing this is the right balance. Finding that balance depends on branding, legal and financial factors. But it's not an unreasonable position.
This is why you have policy for appropriate response and organizational escalation in place if necessary. Not hard to contact the department in question via another directory and verify the request.
There are a significant number of frauds committed by police (using official resources to stalk, bully, or sell information) and they are caught and prosecuted only when people don't help them bypass things the system can reasonably audit.