Sounds a bit clickbait:

allows an attacker to grab the location of any target within a 250 mile radius

So it’s a bit rough… In Europe it means basically which country the target is in. Also cloudflare servers are not evenly distributed in the world, so resolution can differ wildly worldwide.

With a vulnerable app installed on a target’s phone

So it’s not really zero click.

Sounds interesting though, nice writeup, but not as scary as it sounds from the title.