No, they do not lack knowledge. See the sibling comments: the issue is not a concern of what various computer and mobile OSes do, but rather with some CPE firmware still using EUI-64-based IPv6 addresses.
This allows attackers on the Internet to send out probes, find the router's Wifi interface, map it to the BSSID/SSID, and look up the SSID in geolocation database:
* https://www.blackhat.com/us-21/briefings/schedule/#ipvseeyou...
Ideally what they should be doing is contacting vendors to fix their firmware (and also creating CVEs for 'public shaming'), and not telling people to disable IPv6.
Disabling IPv6 does not solve the problem: it is still lurking there for folks that haven't read this site/advice.
Routers will hardly ever make connections themselves out to the internet, except maybe for things like DNS which hopefully are using major providers like Google which won’t leak the data anyway.
The attacker sends a ping to any random address in the /64. The router responds with an ICMP of "timeout" or "unreachable" or something. The ICMP response has the router's IPv6 address.
In badly written routers they use EUI-64 for the local-part of addresses. Further, most devices have interfaces where the MACs are sequential: so if the first interface has 2a:a9:d3:8f:c9:a8, then the next one probably has …:a9, and then :aa, etc.
Then the EUIs-64 and look them up in a Wifi geolocation database:
So it’s both having the EUI-64 address and the router responding with an ICMP message rather than being silent. Got it.
In that scenario, DHCPv6 would be responsible for keeping the assigned subnet filled randomly, rather than being conservative and consistent with address assignments. I don't know if anyone is doing it now, but I don't think we should dismiss IPv6 for this reason.