Although included in Privacy & Security settings, it has nothing to do with TCC or tccutil, but is run largely by its own service locationd. This is what it does, and how to control it.