Technically yes. Toyota can do so but do they really care? No. In fact, more cars than you realize can do so but someone would have to specifically look for you in the sea of millions. I highly doubt anybody is sitting in a room thinking, "Let's see what Bob is up to today."
As far as an individual, they would have to be a good hacker or know how to hire one.
Data is power so I'm sure an entity could buy the data but that comes in large scale trends format generally. An individual can't just call up Toyota and get Bob's whereabouts.
Still unlikely. If they are that determined, it is far easier to just buy a tracker of the the internet and install it on the vehicle. It is relatively inexpensive and usually the most likely scenario.
If this is really an issue, you'd be better off exploring other options than worrying about entune.