Icon base by Lorc under CC BY 3.0 with modifications to add a gradient
The technology works by measuring the time of flight or signal strength between a user's device and multiple nearby WiFi routers
All of that can still be spoofed, and there's no guarantee any other wifi routers are within range. Some adapters won't even background scan at all while you're connected to a station already.
On Android and iOS, apps can get a list of visible BSSIDs without special permissions (on Android 10 and later, ACCESS_FINE_LOCATION is required).
The tech is thwarted without this permission. Unless browsers also share BSSIDs on laptops. Probably chromium does and Firefox followed suit because of Google money
Thwarted in what sense? The vast majority of users on the planet blindly accept fine location permissions for every single app, I think that will make most users of this tech happy enough.
I feel like with WebRTC API it is already possible to fingerprint the network so no need for BSSID. They just need the database of that instead of BSSID