It is interesting to see how this is now suddenly perceived as an issue with iOS 11, while Android already introduced the same behavior with 4.3 in 2013.

The "off" setting these days only indicates that the device will not associate with any WiFi network, but it keeps the radio on for location services.

Without commenting whether this is actually bad for security, articles on the matter should point out that Android phones are doing the same to raise awareness.

Edit: iOS enables WiFi on switching location, but re-enabling WiFi based on known locations is only a new feature of Android 8 Oreo. So for most Android users WiFi will at least not be turned back on automatically yet.