The argument is, fundamentally, that it's not even that. It's not a rough proxy for the thing you want to evaluate, it's not any kind of proxy for it at all - that's a qualitatively different argument from your restatement of it.
If you want a very rough comparative proxy, an obvious one is 'Brave is a much smaller downstream consumer of Chrome, Chrome has a larger security team/infrastructure than Brave has employees'. I think you can draw more meaningful conclusions from that alone than from CVE tallies.
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
No, the device is only receiving the position data from satellites. It then sends the position via the network (internet) to you.
The phone will need network (internet) connection so you require a SIM card. GPS tracking devices usually use special data plans where the providers only allows a couple of megabyte per day, and thus cheaper than any phone plans.
https://www.eiotclub.com/products/gps-tracker-data-plans is $2.20 USD/month.
https://lightbug.io/product/lb-dev-ze2/ for example is 2-3.50 Euro/month if sending every 30 minutes is enough. The company probably pays less than 1 Euro for their data plan before they resell it to end users.