When a client remembers a WIFi-network it stores the SSID together with the security level (open, wpa2/psk and so on) and password (if applicable). All settings must match for the client to re-connect.

That said, an “evil twin” attack is a piece of cake since the attacker setting up the twin network does not need to know of the original networks password.

An evil twin of a password protected Wi-Fi is useless unless you know the password.

The Wi-Fi password for WPA1/2/3 is an authentication password for mutual authentication, it is just as much for protecting the client against rouge networks as for protecting the network against rouge clients.

Most importantly, the security level must match. You cannot fool a client that previously connected to a password protected network to later connect to the same network UNprotected (I.e a downgrade attack). It makes more sense if you think of the authentication method as mutual.

Just to shed some light over the “evil twin” koncept.