Given this, I don’t fully understand the below:
> listening for MAC addresses with prefixes associated with Google
How do you scan MACs without being on the network? Is it like Bluetooth, where everything is constantly broadcasting?
> Attacker sends deauth packets to disconnect the device from its network
How does one send packets to 192.168.X.Y without being on that network already?
It's not sending IP packets; the attacker figures out the wi-fi MAC of the client they want to deauth, then spoofs that MAC in 802.11 "deauth" frames sent to the access point. The access point then complies by cleaning up whatever data structures it's using to keep track of the client, and when it receives the next packets from the client, it doesn't know who it's talking to anymore.
The attacker doesn't need to authenticate to the wifi network to send these frames. At the most they might need root/admin on their machine because you have to send custom packets and that's generally restricted, but as the original article said, there are custom boards that are designed just for deauthing attacks.
It's actually the opposite—WiFi broadcasts MAC addresses in the clear (although likely a random one per-network on modern devices) even with WPA, while BLE can use an Identity Resolving Key when it's not in active discovery mode. This way, a Random Resolvable Private Address can be created that only the paired device can decrypt and find the actual MAC address.