If you got a JBL speaker, you cannot upgrade its firmware without the app. The app requires location access, otherwise it will not work at all. There is no reason for location access because even if you grant access, it doesn't feature anything like a map or compass. It solely uses the location for marketing.
Also, you cannot just search for a new firmware update and uninstall the app immediately afterwards. You have to wait a few days for it to notify you so they can track you for a longer period of time.
That's a violation of the Apple app store terms of service, but I have never yet successfully reported such a violation to Apple. Their tech support doesn't understand what to do with such reports and after many back-and-forth attempts I've just given up trying for now.
Apple employees, if you're reading this, it's an obvious violation of ASRG 5.1.1 (iv) Access and it's probably a violation of ASRG 3.1.4 Hardware Specific Content — but as a mere developer, there's nowhere for me to report that for internal investigation. Perhaps one of you can do better.
Apple employees, if you're reading this, I would _LOVE_ a way to flag an app notification as spam. I use a few apps that I really need notifications on for (delivery apps, and the like) but that insist on spamming me. Pretty sure this is a ToS violation, but I'm entirely unsure how to do anything about this.
It very likely asks the location permission because it wants to scan Bluetooth devices. Scanning Bluetooth devices can be useful to detect the speaker, but it's also often used to track user locations especially indoor where the GPS doesn't work or is not precise enough.
You can place Bluetooth emitter beacons around an area and by scanning the Bluetooth devices on the smartphone and some triangulation, you know precisely where the smartphone is.
bluetooth and location permissions are many times together, because if you can scan the device macs you are able to use it to locate the user ( with bluetooth beacons for example).
Unfortunately, both Google and Apple decided to merge Bluetooth and Location permissions a while back, on the basis that bluetooth scans can be used to unmask your location (by fingerprinting known BLE beacons). This means that any app that needs to communicate over BLE is forced to request the location permission - even if they don't want to.
That's not to say anything about whether this app in particular is using location maliciously, of course. But all apps for BLE devices are in this boat :/
Which is the reason I prefer websites to apps. Ok, there are certain tasks that are not feasible without an app. Mostly though, what's done in the app could be done on a website. And the website is by far more accessible through a wide variety of devices with a range of operating systems.
Also, you cannot just search for a new firmware update and uninstall the app immediately afterwards. You have to wait a few days for it to notify you so they can track you for a longer period of time.