It's always the legacy systems that were never designed with privacy in mind because it was a genuine miracle that they even worked in the first place that seemed to come back and bite us the hardest.
First wap (If I'm getting the name of the company right...) has basically weaponized SS-7 telaphone commands To be able to track anyone with a cell phone without the need of malware or stingrays or fancy devices. It shouldn't be a surprise to anyone, but the only real defense of this is something like a Faraday bag or just not having a fucking cell phone on you.
I'll leave the show notes of last week's Security Now podcast that I'm finally catching up on below and scroll to the near the bottom if you want to read about it or just listen to the last quarter of the episode.
https://www.grc.com/sn/sn-1052.pdf