"please use the original title, unless it is misleading or linkbait; don't editorialize." https://news.ycombinator.com/newsguidelines.html
Also, "Macs" in the submission title makes it look like Apple Macintosh rather than Media Access Control address.
I mean, yes, I suppose the title is technically correct. But phrased another way: there was a security vulnerability which someone found and reported to Apple, and Apple fixed it. Isn't that how things are supposed to work? Unless you expect everyone to write perfect software on the first try.
If your company is prioritizing security and privacy, no, this is not how it's supposed to work.
This shows a failure of the process. By design/default, this MAC address should not be available to system or user processes in IOS. In general, even the randomized MAC address should not be available. The fact that it was available to the mDNS process indicates that there was no security/privacy review of its existing access, no technical measure implemented to break that access until a review or exception was put into place, and no test plan that validated that the MAC address is never sent on the WIFI radio.
but point taken, will edit