SMP pairing behaviour change in SDK 1.5.0

Question

I have recently updated from SDK 1.4.2 to 1.5.0 on an nRF5340-DK

I have an application with a custom ble service. Most of the services have authentication permission requirements on them (e.g. BT_GATT_PERM_READ_AUTHEN), meaning they can only be read/written to after a pairing process has happened. I have left one without this to allow the central to connect without pairing and write to a single characteristic (not important to know, but I use this to trigger an identify to the peripheral so it can indicate it is the physical device I have connected to).

In SDK 1.4.2, if I connected and only used this non-auth characteristic, no pass key request would be triggered. iOS would only then trigger the passkey popup when the central app tried to then read/write an authenticate characteristic.

This I believe is the correct behaviour.

However now using SDK 1.5.0 the pass key request is triggered upon connection, before any characteristic is attempted to be read (or written to). This is not an issue due to my iOS app, as it happens also with the nRF Connect iOS app also.

If I add SMP debug logging (CONFIG_BT_DEBUG_SMP) I can see that (in 1.5.0) an smp_send_security_req is sent upon connection, and presumably that is what is triggering the central to pop up the passkey.

  [00:00:17.142,913] <dbg> bt_smp.bt_smp_accept: conn 0x200013e0 handle 0
  [00:00:17.142,944] <dbg> bt_smp.bt_smp_connected: chan 0x200015f0 cid 0x0006
  [00:00:17.143,066] <inf> ble_handler: Connected 40:9C:28:E5:BE:C5 (public)
=>[00:00:17.148,742] <dbg> bt_smp.smp_send_security_req:
  [00:00:17.150,299] <dbg> bt_smp.smp_init: prnd dcba6c4eaaae22538a378a43feba1aa~
  [00:00:17.150,634] <inf> event_manager: e: ble_connection_event ble_connection_event_type=0
  [00:00:17.754,089] <wrn> bt_l2cap: Ignoring data for unknown CID 0x003a
  [00:00:18.264,434] <dbg> bt_smp.bt_smp_recv: Received SMP code 0x01 len 6
  [00:00:18.264,465] <dbg> bt_smp.smp_pairing_req:
  [00:00:18.264,465] <dbg> bt_smp.legacy_pairing_req:

In 1.4.2 when I connect I see

  [00:00:06.112,823] <dbg> bt_smp.bt_smp_accept: conn 0x20001370 handle 15
  [00:00:06.112,823] <dbg> bt_smp.bt_smp_connected: chan 0x20001578 cid 0x0006
  [00:00:06.112,915] <inf> ble_handler: Connected 7a:54:14:bd:fa:5b (random)
  [00:00:06.113,189] <inf> event_manager: e: ble_connection_event ble_connection_event_type=0
  [00:00:06.710,784] <wrn> bt_l2cap: Ignoring data for unknown CID 0x003a
  [00:00:11.781,127] <inf> ble_handler: Connection parameters updated!
  Connected to: 7a:54:14:bd:fa:5b (random)

Then only if I attempt to read an authenticated characteristic, do I then see smp related paring requests

  [00:01:28.440,124] <dbg> bt_smp.bt_smp_recv: Received SMP code 0x01 len 6
=>[00:01:28.440,155] <dbg> bt_smp.smp_pairing_req:
  [00:01:28.441,680] <dbg> bt_smp.smp_init: prnd 6f62ac037ffc1a46f8ff8802021a9c4~
  [00:01:28.441,680] <dbg> bt_smp.legacy_pairing_req:
  [00:01:28.443,298] <inf> ble_handler: Passkey for 7a:54:14:bd:fa:5b (random): 476765
  [00:01:28.443,542] <inf> event_manager: e: ble_connection_event ble_connection_event_type=2

I have compared the .config files between the two, and cannot see anything configuration wise that would be causing this, so would like some help in figuring it out please.