Don't put them on untrusted networks. This always seemed obvious to me.

Untrusted network is not sufficient, you need to cut them off internet, in general.

My initial read of proximity being sufficient to exploit 3 is incorrect, so yeah as long as you control the Wi-Fi network sufficiently then things should be fine.