It can be spoofed very easily on android. Well, not GPS itself. With developer options you can simulate other GPS locations. So any service that runs on both android and iOS can’t rely on using GPS to catch all users using a VPN.

Also both OSs make it easy for a user to deny an app access to any kind of location info other than the IP address