It doesn't say _any_ device. On the contrary, it sounds like the network admin has to explicitly delegate that authority to the configurator device:

> With Wi-Fi Easy Connect, a network owner chooses one device as the central point of configuration.

https://www.wi-fi.org/discover-wi-fi/wi-fi-easy-connect

Though with WPA2 (personal, at least), isn't it already possible for "any permitted device" to "vouch for new devices" by simply giving those new devices the Wi-Fi password?