On the other hand, the nature of Apple’s BDFL ownership means that they could very easily add a permission prompt in an iOS release, allowing them to default to disabled, then tell app developers to update their code or go to hell. They’ve done it before with other APIs.
In fact they’ve already done this on the web: the DeviceMotion API is behind a permission prompt. I’m surprised the same isn’t the case for apps.