It's likely for Bluetooth access rather than WiFi. It's not uncommon for IoT devices to use bluetooth for setup, and it would be trivially cheap to put BLE beacons on every subway station exit in NYC, essentially giving you fine-enough location detection to uniquely identify most people within a week.