https://www.macworld.com/article/2118771/ios-17-1-private-address-security-hole-fix.html

iOS would respond to address requests with a private address as the source, which made it seem like the feature worked. However, the researchers found that the real, actual MAC address was provided in a different part of the request-response

That seems like a really sloppy implementation of the feature 😂 I’m glad they finally fixed it but how did it take three years to fix this!?