Am I right to understand that this vulnerability only works when Bluetooth is in discoverable mode?

If yes, then most phones are safe even if they have this vulnerability, it's only when you go in the Bluetooth menu that you are at risk...