Bluetooth 4.0 and 4.1 had a broken key exchange that was vulnerable to both passive and active attacks [1]. This could be remedied by a custom in-band or out-of-band key exchange, but I think it was rare for device manufacturers to go to those lengths.
The key exchange vulnerability was addressed in Bluetooth 4.2, which implements ECDH and is at least theoretically secure. [2]
Basically Passkey Entry is broken so eavesdroppers can trivially learn the PIN. You must use a dynamic PIN (not always possible).
Oh and if you're thinking you can implement your own pairing method that is actually secure, via the Out-of-Band method, think again! Neither Android nor iOS support it.
>Neither Android nor iOS support [pairing ... via the Out-of-Band method].
I'm not sure this is actually true (unless you're talking about bugs with individual manufacturers implementation on Android?). Both iOS and Android support SSP with OOB key exchange via NFC.
https://pomcor.com/2015/06/03/has-bluetooth-become-secure/
Basically Passkey Entry is broken so eavesdroppers can trivially learn the PIN. You must use a dynamic PIN (not always possible).
Oh and if you're thinking you can implement your own pairing method that is actually secure, via the Out-of-Band method, think again! Neither Android nor iOS support it.