First of all... you are cofusing BT Classic with BTLE. Your speaker is the former. Second, PWA / webBLE / physical web whatever does have protections in place.

First of all... you are cofusing BT Classic with BTLE. Your speaker is the former. Second, PWA / webBLE / physical web whatever does have protections in place. Iirc you must be explicitly paired using BTLE 4.2 encryption and the connection must be explicitly created by the user.