Google removed the API interface that allows app to do that.
It's not Avast only. Any app cannot do it anymore.
This is incorrect.
On my rooted phone (android v6), I put Avast Anti-Theft and Cerberus.
I moved both to be system apps.
When I send a locate command via Avast, it does not turn on GPS.
When I send a locate command via Cerberus, it does turn on GPS (and turns it off when you send a locate-stop command).
So the capability is definitely there and the problem lies in Avast, not android.
It is a shame. Until now, Avast was by far my favourite anti-theft app. It is the one app that never failed to work whenever I tested it out from time to time.