Sailfish OS leaves BlueZ’s LE privacy feature disabled, so the controller’s fixed identity address is used for advertising and scanning. The hardware supports it: on a Jolla Phone 2026 (jp2601, SFOS 5.2.0.17), btmgmt info lists privacy and static-addr among the controller’s supported settings, while current settings contain neither. /etc/bluetooth/main.conf ships with #Privacy = off commented out, so the default of off applies.
I’d like to request Privacy enabled by default, so the device advertises a resolvable private address that rotates rather than its identity address. I have not tested the effect on paired accessories.
Worth noting alongside the Wi-Fi request: on this device the Bluetooth and Wi-Fi addresses differ by one in the fourth octet (aa:bb:cc:11:22:33 and aa:bb:cc:11:22:32, substituted), so either one reveals the other and randomizing one alone gives less than it appears to.