I mean, I don't know how they do it, maybe they're lying, but if it's possible, then we can safely say that Wi-Fi security is critically low right now.
A WPA3 network with a strong unique key should be safe. Sometimes defaults are predictable and users don't change.
Sometimes "getting free internet" doesn't involve cracking WPA keys. Think unencrypted hotspots with bypassable captive portals and devices with ancient firmware and exploitable CVEs.
I think what we can safely say is that negligent wifi access point operators exist in most residential areas.