@acapit - is this a theoretical concern, or why are you investigating this? It's no secret that MAB is an insecure form of authentication. Just because it falls under the umbrella of "NAC" doesn't mean that it makes network access secure. The clue is in the word "Bypass". It bypasses the real security mechanism, which is 802.1X. And 802.1X is secure because it relies on the client playing its part in the security dance. It takes two to tango! If the client has a supplicant then use it. EAP methods such as EAP-TLS and EAP-TTLS are probably the best form of barrier to entry on a network. And then you should disable MAB. How realistic is it to disable MAB in most networks? Not very, but that's the reality. If the client supports wireless, then rather go wireless because you get security as part of the authentication method.
As for MACsec - I have not seen this used on end clients, but the client needs extra software to make this work (e.g. Cisco's AnyConnect). At that point, if it's a semi-smart device, you probably have 802.1X on the endpoint anyway - just use that instead.
MAB == insecure. It's a reality. It falls on the rest of the network to then try "protect" those untrusted segments, using other detection tools like Netflow, ACLs, Firewals, AVC, DPI, etc. Security In Depth. And to be fair, even with 802.1X, the chances of someone spoofing a certificate on a rogue device are low (but not impossible), all of those security mechanisms won't go amiss either.
