[_flux]

Wouldn't MitM attack work, though?

I found this one, doesn't seem to be maintained but the concept seems clear: https://github.com/PaulPauls/Bluetooth_LE_MITM

It doesn't seem to be concerned about encryption, but would that typically be a problem?