That doesn't necessarily solve the problem. The attack needs to login to some routers to extract the MAC address, but others provide it willingly without login

That doesn't necessarily solve the problem. The attack needs to login to some routers to extract the MAC address, but others provide it willingly without login (I believe DD-WRT does this on the default logged-out status page, for example, although I can't check at the moment).