d9780 Apps only have access to permissions you have granted within the constraints of what you have granted. Apps don't have access to location data if they don't have the Location permission and they can't access it outside of what you've granted. If you allowed location access while in use, they can't access it when not in the foreground where they're visible to you either as a visible window or a visible foreground service. It's the same kind of toggle as the camera and microphone toggles.
Why would a VPN app require the location permission?