iPhone 6 Plus "Feature"

My husband and I discovered a "feature" with the IPhone 6 Plus.  One morning, my husband was able to see my phone under his "WiFi" Connections as a device that was able to be connected to.  (Note:  Not under Bluetooth, Under WiFi.  He wasn't able to see it before that update.)  The problem:  I did not have the "Personal Hotspot" setting turned on on my phone.  I did happen to have my Bluetooth setting turned on so that I could connect to my Fit Bit Surge via Bluetooth.  It gets even worse.  Not only was he able to see my device in his connections, he was able to connect to it without even having to type in a password at all.  (It was set to the default password on the Personal Hotspot settings of the phone.)  When he connected to my phone with his phone, it changed MY "Personal Hotspot" setting to On.  Fortunately, they fixed the authentication issue, requiring him to put in a password, now, however, when I have my Bluetooth on, he can still see my phone under his WiFi connections, and when he tries to connect, it still changes MY "Personal Hotspot" Setting to On.  In the original bug report, I tested it with a device with a different Apple ID, and I was able to see and connect to my phone.  Now the different ID still detects the phone but requires a Bluetooth pairing.  This was with a MacBook Pro, though, not another phone.  I do not know what another phone with a different AppleID will do, considering that I don't own another phone.  I did think that it was prudent to mention that I submitted this "Feature" of another person being able to change my "Personal Hotspot" setting from their device as a bug, however, I was told that as long as it's the same Apple ID on both devices that it was working as intended.  Okay, so how do the devices know that they are on the same ID?  Do they broadcast that information?  Is it stored in the AppleID database under a devices section?  Secondly, what if someone happened to steal the ID and was near enough to automatically connect to my device?  It doesn't sound like a feature to me.  It sounds like a bug that needs to be resolved.  I'm keeping my Bluetooth on my device turned off.  I don't need to sync my FitBit Surge that bad.  If you really need to sync something via Bluetooth, I suggest changing that default password on your "Personal Hotspot" setting just in case, and testing it.