How does Fing detect the model and MacOS version of a device
It's called Network Discovery.
Basically, Fing can get this information because your computer (not limited to Macs) is both broadcasting who/what it's resources are and responding to requests about what resources are available.
There's lots of tools (mostly professional) that will do a &quot;network inventory&quot; of not only what's connected to your network (type of device), but name, OS, installed software, etc.  Network Inventory Advisor is an example of such software (this one is Windows based, but it's product info pages give good examples of what info can be obtained).
So, how can it get it?

DNS Client (how your computer gets an IP address)
SSDP Discovery - Simple Service Discovery Protocol
UPnP - Universal Plug &amp; Play
Zero Config (Bonjour)
OUI (Organizational Unique Identifier)

Using Wireshark (FOSS Network Sniffer) and just evaluating what ports respond, you can start building a network map and determine what computers are on your network.
The OUI alone can give you a clue as to what computer's identity - there are many free tools on the internet like Wireshark's OUI Lookup Tool.  Try it for yourself, paste your MAC address (obtained from ifconfig and see what vendor is identified.  You can obtain all of the MAC addresses on your network segment by pinging your broadcast address.
These are just some of the services on your client machines that advertise what resources are available.  All Fing is doing is utilizing one or more of these (which one they use specifically, I don't know) to do an inventory of the network.
Preventing Discovery
Can you prevent this? To a point.  No matter what, even your MAC address (unless you spoof it) is going to give up some of the goods on you.  Your browser's User Agent String tells whatever server you connect to what your running including the host operating system.  Give it a try with the site WhatIsMyBrowser.com. What does this mean?  Even your applications are giving up the goods on you.
When you attempt to prevent this, you are going to find it difficult to strike a balance between user convenience and perceived security.  These identifiers are shared so that the end user doesn't have to go back to the 1970s and 80s and manually configure services (i.e. printing or network file sharing).  For example, turn off a zero-conf service and you have to manually configure your printer on your client.  You also have to manually configure your printer to not use DHCP because if that IP changes for whatever reason, you have to reconfigure that service again.
Remember, these services are added for user convenience.  Can you turn them off and firewall your computer so it doesn't respond?  Sure.  Have you secured anything?  Not really.
In the book The Art of Deception, the author, Kevin Mitnik (convicted hacker) describes many ways systems are compromised.  There are many tools and steps you can take technologically and yes, you should implement them.  But knowing what OS you're using is irrelevant when the weakest link can be found between the keyboard the chair.  You can turn all of this off tomorrow and with very little effort, can get all this information via social engineering; in other words, just talking to the user.
TL;DR
Basically, you can spend a ton of time trying to make your system invisible with firewalls and disabling services and in the process, &quot;break&quot; the conveniences that were built into the system that makes your computing experience a good one.  Instead, focus on security practices that harden your system.  Knowing that you use macOS Catalina on a MacBook pro or Windows 10 on a Dell XPS is meaningless if you use the same password on a majority of your systems/services, for example.   You would be better served by focusing on not letting unauthorized people onto your network in the first place and if you do have to allow guests, segment them to their own VLAN with access to nothing but the Internet, put time/bandwidth limits in place and lock down the protocols they can use (i.e. http/https only).