I’m optimisticly guessing the devices talk to the router in such a way that their mac addresses can’t be eavesdropped out of the ether, and there’s enough mac addresses in the universe that cycling through spoofed addresses is unlikely to be fruitful.

Though, I could learn a device’s mac address by setting up a competing wifi device, possibly by a: having a battery-operated one during a power outage or b: being friendly with my neighbors “sure you can borrow my Wi-Fi”.

Now I’m curious how mac addresses are determined (like, is a Pixel 3’s mac address going to follow a specific pattern?) and I’m going to go look that up.