It appears you are mistaken: a properly configured little snitch will protect you. You can configure APS (automatic profile switching) to pause and ask every time your mac connects to an unknown network -- not a device, as I imagined, but a network.

Here is a detailed post: https://blog.obdev.at/automatic-profile-switching/