They are responsible, as this usage is clearly here by default and by design. This isn’t the case with a pen or a computer. A tag has just one purpose, tracking, not multiple like a computer. This is a huge difference. When you come to privacy of a human, you must be precocious.
You can regulate it. It has not to be used as a stalking device by design. It still allows them on the market with this restriction. The second is to opt out by default from the system. People have to manually opt in in the settings, with a mandatory pop-up explaining the risk. It reduces the number of phone able to send back the location. Another regulation could stipulate the ban at the OS level from the functionality and make the download of an app mandatory.
All of these examples of regulation protect the basic citizen from the stalking capabilities, but don’t ban the product itself. It mitigates the risks. It’s good for the company and good for the citizen privacy.