Even in BT mode I think the PF service will be open, but the V2 secure DFU service will not be. So on iOS I observed that we don't pair when we expect to (start notifications on partial flashing) and DFU fails to do so.
What about V1?
Does microbit-foundation/nordic-dfu#4 help at all?