This is not a Bluetooth issue. The chip manufacturer Airoha just felt it acceptable to ship a wireless debug interface that allows reading the SoC memory with no authentication whatsoever, enabled in retail customer builds. They are just not a serious company (which is why their security email didn't work, either).

I mean, most companies have security last on their budget list.

It tells more about human nature than about a company.

This can only be fixed systemically by huge fines and/or imprisonment. Otherwise the temptation of taking the risk to neglect security is too strong.

Wireless 'JTAG'! The Dream :)