Can apps know where you are even without GPS? I've noticed that Google Maps, for instance, can guess where you are using phone towers or something even when GPS is turned off.

Does this apply to 3rd party apps? Can any app figure out where you are?

If so, are there large security implications there? 

Basically as a developer, couldn't you build a background process that tracks every the location of every phone that has your app installed?
Apps can get your approximate location without GPS, but only if they have the "coarse location" permission.  The "fine location" permission lets an app get your GPS location too, if GPS is enabled.

When you an install an app, Android shows you the permissions it needs.  If you don't see coarse or fine location in the list, the app can't get your location.