Currently, even if player-tracker.enabled is set to false for a world, the tiles/players.json file still lists all players in that world, is this really necesary?
This exposes player locations when somebody goes to this file via URL.
Is it possible to not add these players to tiles/players.json, if player-tracking.enabled is set to false for these worlds?

Surely you could configure your server not to serve those files, no? Seems easier.