MAC addresses are already quite predictable since they are only 48-bit values which are attributed by ranges to hardware vendors (see for instance this file). It is possible to change the MAC address used by a network interface, but most people do not. Also, a given device will broadcast its MAC address quite freely (it is included in the header of each ethernet frame it sends).
There are some sites where MAC addresses are filtered; i.e., data sent by a device is automatically dropped by the router unless it seems to come from a specific, registered MAC address. Many WiFi access points can be configured that way, and it is also common in organizational LAN (as a deterrent for people who thought BYOD might be a good idea). If you know the MAC address of an "allowed" host, then you can bypass this filter by changing your own MAC address to that value. That's not really a security issue related to knowing the MAC address of a machine; rather, the problem is sysadmins who believe that a MAC address can be used as a kind of secret password.
Theoretically, MAC addresses are local only, a matter of convention between the hosts on a LAN, and have no meaning beyond the first router. This would make security issues related to MAC knowledge impossible beyond the first router. IPv6 changes that a bit: if, on a given LAN, the following happens:
- the sysadmin has configured everything for IPv4, with NAT: he feels confident that internal hosts cannot be contacted from the outside except by using the specific forwarding rules he sets on the exit router;
- the operating systems of the router and internal hosts are actually IPv6-aware (all modern OS are);
- the ISP, as an experiment, decides to "enable IPv6", and the cable/DSL modem used as exit point begins to broadcast router advertisement packets;
then, suddenly, the internal hosts of that network can be contacted from the outside, using IPv6. The IPv6 addresses will be derived from the MAC address, so trouble will not happen right away. But once attackers guess the MAC address of some internal hosts, they will be able to connect to them directly.
The problems here is that NAT is not a firewall; its isolation effect is only a byproduct. However, it can be predicted that many sysadmin see NAT as a security feature, and will consider privacy of the MAC address as another security feature.