I don't use bluetooth much and I have no idea what the technical details are, but surely an attacker can find a way to either guess or determine what bluetooth

I don't use bluetooth much and I have no idea what the technical details are, but surely an attacker can find a way to either guess or determine what bluetooth devices your phone is paired to and then pretend to be that device. (like a keyboard) Also according to my experience there is no "permission for bluetooth", it all falls under "Phone" or whatever other permission on Android.