I mean, I don't know how they do it, maybe they're lying, but if it's possible, then we can safely say that Wi-Fi security is critically low right now.
A WPA3 network with a strong unique key should be safe. Sometimes defaults are predictable and users don't change.
Sometimes "getting free internet" doesn't involve cracking WPA keys. Think unencrypted hotspots with bypassable captive portals and devices with ancient firmware and exploitable CVEs.
I think what we can safely say is that negligent wifi access point operators exist in most residential areas.
It's not impossible that it could be done with a smartphone, although that would make the task even more difficult. Since you can't really "casually" crack WPA3 (as far as I'm aware), I doubt that anybody is doing it that way. They'd be more likely to pick up more suitable kit for $100-$200.