A Letter to the Strava Community (opens in new tab)

It seems pretty evident that people thought this was private, and Strava did a bad job of communicating that it wasn't. There is also the issue of people in rural areas where they are potentially identifiable.

If the user was not aware its location was being uploaded, then yes, it is Strava's fault. They should not be using your data, on the assumption that it is not sensitive, without explicit consent (preferably opt-in). They are only following the "industry standard" though. I bet the military would be surprised on how much location data leaks to Google location history, the only difference being it is not publicly available (yet).