This is, as far as I can tell, completely false.
Apple has been asking for explicit opt-ins for years, and is only now requiring apps to follow suit.
You may not remember it, and I think that some of the opt-ins persist across device restores, but all the data collection is through explicit opt-ins.
And it is opt-in.
They should all be opt-in.