When WiFi is enabled, iOS devices broadcast a list of known SSIDs and possibly the MAC addresses of some known routers. Has that changed?

https://arstechnica.com/gadgets/2012/03/anatomy-of-an-iphone...

https://lists.immunityinc.com/pipermail/dailydave/2012-March...

This behavior is called active scanning and is part of wifi spec. All wifi clients do it:

https://www.wi-fi.org/knowledge-center/faq/what-are-passive-...

If you go to defcon and open your laptop there are usually screens that show all of the networks nearby devices have previously connected to.

I can't speak to that with accuracy (other than the fact that information is from 2012)

But it doesn't make sense to me it would be probing for known networks in it's disconnected state.

Infosec experts will comment in due course, since there are now a few million reasons to find out definitively.