It’s too complicated. Bluetooth is complicated. It tries to do way too much, and not even the experts can implement it in a consistent fashion because different Bluetooth stacks are forced to make assumptions where the specification is unclear.

When you have a large, complex, and poorly designed specification, you’re going to get bugs. The main limiting factor has been the short range of Bluetooth preventing widespread exploitation.