My understanding of Bluetooth is that applications using Bluetooth have direct access to the device MAC address for the purpose of pairing. I will assume this for this answer.
If you can read MAC addresses of WiFi or Bluetooth transmitters, you can locate a device. This is how WiFi/Bluetooth location works; you listen for MAC addresses of transmitters and look these up in a giant global database.
Therefore, any application using Bluetooth and a data connection is theoretically capable of locating your device. I am not sure this is practically possible; Bluetooth does not have the same range and semi-permanent access point infrastructure as WiFi.
By requiring location services to access Bluetooth, you ensure that the user understands their location information may leak when they use Bluetooth. In versions of Android prior to Marshmallow, the user could use Bluetooth without location services enabled, but location information could leak. In these older versions, you could also run WiFi scans to find MAC addresses without location services enabled, which again meant that your location information could leak. The requirement to allow location services to use Bluetooth is about ensuring that someone who disables location keeps their location private.
I would characterize this issue as a design problem and not a bug. A bug is presumably fixable, but it's not clear to me you can use Bluetooth at all without potentially leaking location information. Bluetooth was created before anyone considered WiFi and Bluetooth location services.