If the user was not aware its location was being uploaded, then yes, it is Strava's fault. They should not be using your data, on the assumption that it is not sensitive, without explicit consent (preferably opt-in).
They are only following the "industry standard" though. I bet the military would be surprised on how much location data leaks to Google location history, the only difference being it is not publicly available (yet).
