I think you're misunderstanding what they are saying. They don't use background location data, but they do use your current location data. Try the "Find My Train" demo on their site - it asks for location permission.
Or their API - it also expects device location data:
> At a minimum, requests to the detect endpoint _must_ contain a device's location measurement. Additional fields can be included where available to improve the accuracy of the returned results as outlined below.
You are giving it to them. That's why the demo asks for your location permission, and that's why the API expects location info.
"You" here means another app that integrates their API (or you as an individual using the demo on their website). How the other app gets it is up to the other app - ideally it also just queries it directly and requires location permission.
Not sure how you came to that conclusion. An empty train would still exist in the live train data. It does not depend on mobile phones, but on rail signals and other such tracking built into the rail infrastructure.
The location of the train comes from trackside sensors and is available as a free API. It doesn't give actual lat/lon – it only shows when it went past a particular checkpoint. The part that needs location permission is the one that works out which train you are on. It doesn't use that to produce the main map, it's just to work out which train you are likely to be on.
Or their API - it also expects device location data:
> At a minimum, requests to the detect endpoint _must_ contain a device's location measurement. Additional fields can be included where available to improve the accuracy of the returned results as outlined below.
https://docs.signalbox.io/docs#/operations/Detect_detect