I'm cynical about the "timing" in another way. that if an AP captures a sequence of the "random" addresses an institution can subpena whatever unique seed was assigned to each iDevice to feed whatever PRNG is shuffling the MAC addresses