The cellular companies themselves are a source for this, as they don't even need GPS or app permissions to triangulate your rough location.

Apps that have access to look for networks can also be used to infer location. E.g., combine multiple known WiFi SSIDs or Bluetooth devices together and you can get a rough location.

Also, most people just hit "accept" for a whole bunch of app permissions and just forget about it. The fact that you even know which apps have which permissions at all means you are almost certainly more careful than the average person, even though you are saying this in the context of a stock Pixel phone.

And, oh yeah, most people have much more invasive Android phone brands than Pixel...cheap phones with a bunch of carrier/advertising partner spyware sell far better than Google's phones. Does Samsung still install the Facebook app by default like they used to? I think it used to be impossible to fully delete, even!