Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
There are many ways this can be done, only really limited by capabilities of smartphones, but here are a few common examples:
Access point: the device broadcasts its own WiFi access point. The device's WiFi settings are configured using normal protocols (commonly HTTP) via the mobile app or manually through a web browser. Ideally, HTTPS would be used, but using WPA2 or later with an unpredictable, device-unique passphrase is also usually sufficient.
Bluetooth/BLE: Using one of several possible pairing mechanisms, the phone finds and pairs with the device, followed by pushing configurations. Generally, Bluetooth will use encryption, but there are insecure ways to pair or transfer data.
Others: WiFi configuration data can be transferred over almost anything, such as light flashes, NFC, unaudiable noises, etc. Encryption seems unlikely in most cases.