Now you want to change the MAC address of your device X, to spoof the MAC address of sensor Y. But how do you sniff the MAC address of sensor Y if there is no packet from or to Y on the part of the network you're listening to?
The MAC comments were in relation to ADFX which was developed for the A380, and then adopted by industry. Earlier aircraft like the one this person targeted use a different ARINC bus, my understanding these are linear buses where any device on the bus can listen to the bus. The bus design itself can be centrally controlled, or as in ARINC 629, control over the bus is distributed. Those buses are normally segregated/partitioned according to their function, and gateways/bridges connect different partitions.