You might not be able to turn bluetooth off, but you can choose not to pair them with anything (or remove the pairing after setting up the device).
Have a colorful switch to enable it, whatever.
But poor security posture out of the box, for a questionably-supported, poorly-developed, long-lived physical device seems important enough to mandate slight one-time inconvenience.
In the future, this bullshit is going to be looked back at like default passwords on ISP WAPs.