I think that you are spot on the principle of how this works and what it achieves but I am just not too sure that it does it by spoofing the MAC address. I think it somehow takes over the parent router’s ARP table but I have no idea as to the technical details here.