The app isn’t using iOS’s Location Tracking services though it can track you in different ways (none of which have anything to do with iOS or Apple)
Does that mean the app can’t access the device location? (Then why is “location“ listed in the privacy label?)
If you disable Location Services globally then run the App and it doesn’t prompt you to enable them, it’s not using Location Services on your device.
The label, as you described it, is nothing more than a disclosure by developer detailing what they could potentially track, not what they are actually doing. If they say they track something, but don’t, then no harm no foul. If they don’t disclose something but actually engage in an activity, they can be sanctioned by Apple. Why the developer said they track you/your device but not actually track using Location Services is up to them.
Or, does this mean the app has some other way of accessing device location that does not require user permission?
Yes, they can track you in other ways such as your public IP address or SSID (iOS 13 and older). Neither of these are part if Location Services - they will know your IP simply from the request from the App to the server; you can’t block that. In fact, it can be argued that it’s the developers right to know where the server requests are coming from.
If they know your SSID and BSSID (which they will if they access Networking) they can look up that value in a database to pin point your location. Granted, it won’t be precise, but generally within a few hundred meters.
Cross referencing the geo-IP with the geo-SSID and then linking it to your account, the developer can have a fairly good idea of where you are and track you with a fairly good degree of certainty.
Below is an SSID map for the Fort Lauderdale area as of this posting. Using the search tools on this website, anyone can determine a device’s relative location with a known SSID and BSSID.
Even if they can’t get your SSID (iOS 14 and newer), the IP alone is more than enough to reasonably track your general location and associate it to an account. Remember, large companies (malls, airports, hospitals, government entities, etc.) that offer free Wi-Fi access to the Internet often have their own public IP address that map right to their physical location - meaning it’s pretty accurate!
None of this requires your permission and it all happens on the server (back end) well outside of your device and iOS.