BLE is not insecure if you configure the pairing process to use LE Secure Connections with authenticated pairing, which does exactly what you have implemented (ECDH key agreement). "Just Works" pairing is the only method vulnerable to MITM because it doesn't require out-of-band confirmation.

Further, “just works” Bluetooth encryption is not vulnerable most of the time. It’s only vulnerable at the instance of pairing.

It shares exchanges a pre-shared key one time at pairing then trusts that both sides will remember the PSK.

So long as you pair while there is definitely nobody around and sniffing Bluetooth traffic, it’s an excellent system.

But the author clearly wanted to go through the effort of implementing Duffy Hellman for this.