This should be a separate permission, asking to do a one-time scan for bluetooth devices with limited scope (predefined OUIs). Same for wifi scanning.

I have no idea why google bundled those together, instead of treating them as separate things alltogether.