alt Hacker NewsCell tower data is readily available for a modest price. It's not hard to triangulate someone with "good enough" accuracy for marketing purposes.
Also, the world is filled with millions of Bluetooth-logging devices. They're everywhere from department stores (to monitor foot traffic) to the side of the road (to monitor traffic speed).
Reading cell towers also is supposed to be behind the location tracking flag. Including bluetooth by the way, which is why so many apps need this permission these days to even link a BLE device.
And tracking bluetooth emissions shouldn't matter as they are randomised while not in an active connection.