Option to disable active Wi-Fi scanning (probe requests)
NM already enhances privacy with options to randomize source address when actively probing Wi-Fi networks (sending out probe requests). However, probe request frames can leak all or some of the client's saved SSIDs, which can still present a privacy risk. Wi-Fi interfaces can also work in passive-scanning mode where active probe responses are not provoked, but an interface only listens for beacons to detect APs.
NM could provide a per-interface option to select passive or active Wi-Fi scanning mode. It is a pretty basic setting anyway. There is a possibility that some Wi-Fi cards would not work properly with passive scan only, so the default setting can still be active probing. But I think NM needs an option to behave not as leaky if that is desired by the user.