It is not just the start/stop location that is good to keep private, but the timing. Most runners follow a pretty standard routine, so if you know where someone lives within a mile or two, and know exactly when they run every day, you can easily track them down. She said that she was approached by someone and that creeped her out.
Strava does give you the option to obscure the start/stop location within a mile so that people can't see your exact address. I think it would make sense to offer an option to completely remove all gps and clock time data. The public would still see the date, run time, distance, splits, elevation, etc, but no clock time, no gps track. This would not be hard to implement. I am a cyclist and I use a similar existing option to obscure my HR, cadence and Power Meter data from the public view. I can still see the data, but the public cannot. Since power is the holy grail of cycling, there is a tendency to try to push the power higher if the public is watching (let's face it, we all strive to impress on social media whether we intend to or not). This way, I don't have to worry about pusing too much power for the given workout and can focus on the goal.
If Molly is savvy, she should engage with Strava immediately now that she has everyone's attention, become a paid sponsored athlete, and work with them to implement these basic privacy features, and then publicly advertise that Strava is a healthy and safe place for all athletes to share their experiences.