Notifications are a free for all, security be damned.

Nimble automatically creates a Client Configuration Characteristic for every Characteristic that allows notifications or indications that is writeable without encryption or authentication:

https://github.com/apache/mynewt-nimble/blob/c802fe74b3034bd163f98e1de5761ac216ba43d6/nimble/host/src/ble_gatts.c#L823

This allows any connected client to subscribe to any notification and get the values in plain text, independent of the confidentiality settings of the characteristic itself.

It should probably set the appropriate `BLE_ATT_F_READ_*` and `BLE_ATT_F_WRITE_*` flags if any of `BLE_ATT_F_READ_{ENC,AUTHEN,AUTHOR}` is set for the base characteristic.