At least on iOS it is only randomized while scanning, not while connecting to networks you have used before. Which is kind of obvious because otherwise your login won't persist.
Yes, but this is easy to opt-out from. Naturally, this is not what they are doing:
> At the end of 2016, TfL ran a pilot which tracked the Wi-Fi signals from 5.6 million phones as people moved around the London Underground, even if they weren't connected to a Wi-Fi network.