I thought it was designed to prevent unwanted people from tracking you. If I bought an airtag, you could track it? Without authentication or authorization?
Only if you have the private key belonging to the AirTag at the time of location capture. Anyone can download encrypted location reports for any AirTag found in the wild, but only the owner can decrypt them with the private key.
That’s kind of how the whole system works.