So if I download an image from the web with GPS data, and then open it in an app that just reads images (so it doesn’t need location permissions)… That app (on some phones) gets a modified version of the file?

Which could make me think that the image doesn’t have location information.

Which could result in me uploading that file using a browser (that does have location permission turned on) to a website, and I think it’s safe to share because there’s no private information in the image, but my phone has conspired to mislead me.

Yes, that is cursed.

Page 15 of the pdf has this chart

(note the vertical axis starts at 60% acceptance rate)