> only the Bluetooth MAC address of the target devices has to be known
Android has a feature of "Bluetooth scanning" to improve device location (similar to Wifi scanning). I'm not sure, but even if Bluetooth is disabled in the menu, this might still activate Bluetooth occasionally and perhaps reveal the Bluetooth MAC to the (nearby) world?