(Why) Do I need Network-based location? (specifically: µG UnifiedNlp)

For microG to impersonate Google Services, it needs signature spoofing. Just use Tingle.

To know more about the Android security model, or why this is needed, check other posts of mine like this one quoted below:

Sadly, Signal and other bunch of free apps depend on crappy proprietary GMS to work.

About your update concerns, Tingle patch (i.e. modifies) the system, so when you update the system to a newer, pristine version of FP Open, you’ll need to patch it again. But so far, you won’t have any other problem with the Fairphone Updater.

2 Likes