Earlier quoted context omitted.
Recent Android and iOS versions randomize the MAC when scanning.
True, but in Android's case, the implementation seems to be flawed: In our lab environment we observed that in addition to periodic global MAC addressed probe requests, we were able to force the transmission of additional such probes for all Android devices. First, anytime the user simply turned on the screen, a set of global probe requests were transmitted. An active user, in effect, renders randomization moot, elim…
Amusingly enough, that's probably more because of an oversight by the manufacturer (who is probably just copying a reference design) --- they don't bother writing a "fixed MAC" and just leave the NVRAM blank, meaning the device doesn't actually have a MAC and generates a random one every time you turn WiFi on and off.
That's how it works on the Mediatek platforms that I'm more familiar with, and you'll find this is the case for a lot of the cheap Chinese unbranded phones. It's irritating when you need to connect to networks using MAC filtering, but I'm almost tempted to respond to all the "my MAC keeps changing" threads on XDA with "that's a feature, not a bug." ;-)