I blame the WiFi protocol. Since the routers are already broadcasting their SSID why are devices themselves broadcasting sensitive information back to them before the user has shown any interest in any particular hotspot?

This over sharing should be addressed at protocol level.