Query Apple's FindMy network with Python

Importantly, it works in a peer-to-peer kind of way. Apple devices act as kind of beacons and nearby iPhones can notify Apple servers of any nearby devices they detect (in a way not decryptable by Apple, only by the owner of the devices).

So AirTags, MacBooks, and turned-off iPhones are findable via passing-by turned-on iPhones.

Is it not a glaring privacy and security hole that turned-off devices can still be located?

Maybe it's just me, but if I own an internet-connected device and I turn it off, I expect it to be off. That an iPhone's definition of "off" means "you can't use it but other random people's iPhones in the vicinity can still connect to and ping it" rubs me the wrong way.

The off-but-still-on functionality can be turned off, and the OS does disclose that by default the device is still findable on the power off screen.

It is not. If you don’t want your device to participate, you ca elect not to enable Find My during setup. The vast majority of people would rather a their couldn’t just turn off a stolen phone and render it unlocatable.

Also the location is only accessible to you, the owner of the device. Not Apple or "random other people's iPhones".

The engineering and thought that went into the whole thing to be useful but also privacy protecting is actually pretty impressive, and exactly the kind of thing we should be encouraging companies to do if we care about privacy. Especially since as you point out, you can still easily turn it off at any point if you want.

Other phones in the vicinity don't connect to yours. Yours uses Bluetooth LE to periodically broadcast some data. Other phones in the vicinity relay that data along with the approximate location to Apple.