It looks like the script uses arp-scan to detect cameras. That is an ethernet-level tool so it will detect only devices on the wifi network your computer is connected to, not all networks within range.
Yep, you're right. An 802.11 client broadcasts the MAC address in every frame in plaintext, so a more straightforward approach would be to use `airodump-ng` to list the cams. The innocent bystander practical & legal concerns were probably the reason author did it this way.