I mean, just look at what happened over in ios land. Every time there is a new security issue or denial of service attack on their bluetooth stack, apple has to scramble to fix it because bluetooth is always on in their devices. Android at least has some respite by turning off bluetooth, especially on old devices that no longer receiving security updates.