On Android and iOS, apps can get a list of visible BSSIDs without special permissions (on Android 10 and later, ACCESS_FINE_LOCATION is required).
The tech is thwarted without this permission. Unless browsers also share BSSIDs on laptops. Probably chromium does and Firefox followed suit because of Google money