I think there is the distinction between the car itself tracking you via built-in capabilities (some of which requires you registering and using the app), a LoJack device you wanted and paid for that piggybacks on the ODBII port, and some nefarious installation (or I think I've seen some commenters on social media suggest that if you have poor credit a lender may demand it - no clue if that is based in reality).
I've also seen a post noting that even if you don't use the Toyota app, it may still track you and/or have your details - there are sites that supposedly allow you to further opt out and remove that information from Toyota if you are so inclined - I don't use the app, but had to do a one time registration to get my stuff working - haven't tried the sites that supposedly get them to remove it (may be part of the right to privacy / GDPR stuff).
(further amusement in the case of someone being concerned about tracking and then posting that on FB from the phone, which absolutely tracks you even more deeply)