I feel like they dropped the ball with respect to spec compliance. I have some speakers that allow anybody to pair with them, even if they don't have physical access to the device, and I occasionally have apartment neighbors connect to them and start playing music. That shouldn't be possible...but anybody can just say that their product is Bluetooth compatible and get away with it.
They should have a rigid spec and a publicly available test kit, and a certification process for spec compliance.
"They should have a rigid spec and a publicly available test kit, and a certification process for spec compliance."
They do. One can only put the Bluetooth logo if the product passes compliance tests. For the pairing, Bluetooth allows different modes. Predictably, the least secure one became the most popular.
They should have a rigid spec and a publicly available test kit, and a certification process for spec compliance.