I think it’s also possible to piggyback on other devices signed with the same certificate to exfiltrate using BLE. Maybe I’m wrong though.