As per the Bluetooth Spec (v5.0) Page 2323-2324, it seems that LE Secure connections pairing supports 1-way OOB. See section of text below.
If OOB communication is possible only one way, how does the device (device B) that does not support OOB get to know the device address of the other (device A)? Based on this figure, device address is also transmitted over OOB and this device address is used to calculate LTK in Authentication Stage 2.
