This is not an issue, it is intended behaviour because BLE devices can give out location information. You must add the location services permissions, and if you are building against API 23+, you must ask for permissions in runtime.
You are completely right! I am a super-newbie in Android, and I have many problems asking these permissions in runtime. I have been trying to look for examples for BLE, but most of the code that I find use lower API's. The only one that has worked (populated the list) is this one: