The fact that their bulletins say that there are high and critical vulnerabilities every month is sort of my point. Is this thing actually critical? Can you only send the vulnerable commands after you have paired? [0] suggests these are used after pairing, but like I said I'm not familiar enough with BT. If that's the case though, "User interaction is not needed for exploitation" is misleading; I'm not going to pair with random devices, so I'm not concerned. I see that with other vulnerabilities too. e.g. CVE-2024-31320 from last year is "critical", and says "there is a possible way to establish a companion device association without any confirmation due to CDM. User interaction is not needed for exploitation." Except if I'm understanding correctly, you need to install a malicious app, and what it does is let that app use a bluetooth device without asking. Big whoop, that's how everything works on desktop, and it's fine.

The problem is the security industry has such a low signal:noise ratio that it makes sense to just ignore everything they say as a user. They're constantly lying and saying there are important security updates when there aren't, and that everything is high/critical severity when it isn't. In a corporate setting, you just unthinkingly update to check boxes, but as an individual, it makes no sense to do that. And with Android, you have to take possibly undesirable feature updates to get kernel or system library updates. For some products, security updates are to "secure" the device against its owner! Advisories are often lacking enough information to be able to evaluate impact, which further makes it clear that the people publishing them are to be viewed with a skeptical eye.

It should be immediately obvious whether this is exploitable by random passersby (if it actually is) without me having to go learn how bluetooth works at a protocol level. "Don't think about it and just update, install a new OS, or buy new devices" is not a useful attitude.

Things don't become end of life when they stop receiving updates. They become finished. Whether and for what purposes they continue to be useful requires ongoing judgement.

[0] https://learn.adafruit.com/introduction-to-bluetooth-low-ene...