The OP asked about Pairing (the original, privacy-safe Bluetooth method to define a new, trusted relationship by confirming a code sent from the other device). For pairing, an app DOES NOT need:
- Scan for a MAC address
- "Location Services"
- ACCESS_FINE_LOCATION or ACCESS_COARSE_LOCATION (not 100% sure on this)
I believe the Bug #185370 is unrelated. There is no bug; there are dishonest vendors.
A MAC address has a manufacturer ID and device ID, and usually a model number. Android 6.0 castrated a feature which previously allowed a manufacturer's app to scan for MAC addresses to link to their own products, to save you the trouble of Pairing and other fun things.
However, many apps abused it to find all WiFi & Bluetooth products in your home, what car you drive, your data providers, etc, and figure out out where you work, what your friends have or who they are, how often you visit, which stores you go to, etc. (think marketing, election meddling and "free" games from other countries).
From Google: "To provide users with greater data protection, starting in this release, Android removes programmatic access to the device’s local hardware identifier for apps using the Wi-Fi and Bluetooth APIs. The WifiInfo.getMacAddress() and theBluetoothAdapter.getAddress() methods now return a constant value of 02:00:00:00:00:00."
Again, Location services are not needed for "Pairing". This is from my new Bluetooth "BlueDriver" ODBII vehicle code scanner (i.e., check engine light):
BlueDriver can use the Bluetooth Location service to scan for
nearby BlueDriver sensors. Instead, if you wish, you can pair
a sensor in the Bluetooth settings of your phone.
(At first glance of their Privacy Statement I freaked: they will upload to their servers, the VIN (includes mfr, model, ID, etc.) of every car I service, plus all of the car's data with driving habits, etc.; I can't opt-out of ADS pouring into my email. Then I read it to the end. I found they have very strict policies about keeping it private and NOT sharing it. Very unusual!)
Location Services can be legitimate. The Fitbit app doesn't need it to connect to my Fitbit, but it may help them gather all the data they want from me. And believe me, it's plenty more than they need to check my heart rate and count my steps, and the mapping is optional.