[ayakura]

Direct link to research paper: https://www.usenix.org/system/files/sec19-antonioli.pdf

Relevant results are on page 1057. It's crazy to think all of the devices tested were vulnerable up to Bluetooth 5.0, but at least the attacker would need to be within range of broadcast, as another user pointed out

[ryanisnan]

but at least the attacker would need to be within range of broadcast

So anyone who lives in a small footprint high-rise or spends ample time on a coffee shop. Yikes!

edit: format