This isn't really that secure. First, anyone with a laptop in range can capture any Wi-Fi packets sent with a tool like Kismet or similar. If those packets are not encrypted, then anyone can intercept them. Moreover, any reasonably determined attacker can also send spoofed packets pretending to be from an authenticated user whose MAC address and IP address they can determine. Using a secure WPA2 or WPA3 configuration, whether using PSK or EAP, prevents this from happening.
Second, anyone who is able to be on the network (whether that's by spoofing packets as above or as a real, legitimate user) can probably intercept traffic for any device on that network provided it's on the same VLAN. For IPv4, this is done via an ARP spoofing attack, which can be carried out with a tool like Ettercap. WPA2 and WPA3 prevent random people from doing this unauthenticated, but of course that doesn't prevent a malicious user who is legitimately authenticated from doing this.
Even with WPA2, it's still possible for a random attacker to conduct certain attacks, such as disassociation attacks, unless 802.11w management frame protection is used. WPA3 makes 802.11w mandatory, so these attacks cannot succeed there.
However, having said all that, this is no less insecure than being on the Internet in general. We assume on the Internet that bad actors can tamper with any data that is not integrity protected and can read any data that is not encrypted. We therefore use strong encryption with robust integrity protection, such as TLS (used in HTTPS) or SSH, for almost all our data. Even public data such as DNS responses may be encrypted or signed (e.g., with DNSSEC) to ensure its integrity and prevent bad actors from tampering with it.
I suspect CERN realizes this and is more interested in making it difficult for bad actors to send packets from their network to elsewhere on the Internet. They know that modern users use secure protocols for almost everything online. Additionally, setting up WPA2-EAP requires a special profile to be set up on iPhones and can't be done without that special profile, adding additional burden for some users.
If this were my network, I would set up something like WPA2-EAP with EAP-TTLS because it's a good defense in depth measure and it makes it harder for people to be a bad actor on the network by spoofing other users. It also provides a small amount of protection for data which is normally sent unencrypted, like DNS requests.