Hacker News Reader

Since Android 9 there is an option to use randomized MACs for the actual connection (not just probing).

Who's to say that a stingray won't overwrite those settings though?

The AOSP security model.

Most folks won't be aware of an option unless it is default.

On my Samsung Galaxy S10e (Android 10) it is the default

That's for probing only, randomization on connection is accessible via developer options only.

The defaults changed in Android 10:

[Starting] In Android 10, MAC randomization is enabled by default for client mode, SoftAp, and Wi-Fi Direct.