I've recently been looking at a few of the low-end WiFi modules used in IoT devices, such as the TLGUA06 and ESP2866.
As expected, it's possible to deauthenticate these devices by sending a deauthentication frame. This is as per the WiFi specifications.
However, both of these devices will re-join an open network with the same ESSID. There is no requirement to clone the MAC of the AP or anything.
This obviously leads to evil twin attacks. Combined with the common use of insecure protocols, an attacker can easily intercept or MITM communications.
OSX complains when you try this attack, as do many versions of Windows. My iPhone complains, but my Android phone doesn't.
Why do these devices not protect against evil twin attacks? I understand this may be a trade-off between security and reliability, but there are no settings or controls that would allow a manufacturer to chose to make a more secure system.
Have I missed another reason as to why these attacks are possible?
What strategies can be used to protect against evil twin attacks?