iOS would respond to address requests with a private address as the source, which made it seem like the feature worked. However, the researchers found that the real, actual MAC address was provided in a different part of the request-response

That seems like a really sloppy implementation of the feature 😂 I’m glad they finally fixed it but how did it take three years to fix this!?