> How do you scan MACs without being on the network? Is it like Bluetooth, where everything is constantly broadcasting?

It's actually the opposite—WiFi broadcasts MAC addresses in the clear (although likely a random one per-network on modern devices) even with WPA, while BLE can use an Identity Resolving Key when it's not in active discovery mode. This way, a Random Resolvable Private Address can be created that only the paired device can decrypt and find the actual MAC address.