You're right, MAC-based defenses don't work for this type of attack; even if you came up with some scheme where a switch port won't get turned on until you announce yourself from a trusted MAC, you can always MITM a phone/computer on the network and get it that way.

The real solution here is proper network segregation and requiring encrypted traffic across the board, with sane key distribution schemes. But that's difficult and expensive.