Yep, you're right. An 802.11 client broadcasts the MAC address in every frame in plaintext, so a more straightforward approach would be to use `airodump-ng` to list the cams. The innocent bystander practical & legal concerns were probably the reason author did it this way.