That is the "Continuity Protocol". For a paper with a write-up on reverse engineering/tracking here is some stuff from last year. [1]
tldr, yes, it can be used to track individual users, but doing it at scale (like just about everything else) would be significantly more difficult. MACs randomize every 15 minutes, so that is not effective for long term tracking. Continuity Protocol allows a fairly effective way of tracking a device in a limited ecosystem, but with the expectation of large numbers of people spread over large areas, it would likely wind up being significantly less effective.
That is nice if it's doing that. I setup a shortcut so that I can fully turn off bluetooth when I leave the house, but it's a bit flaky: sometimes it works, sometimes it fails for unknown reasons and I end up having to go into settings. If this mitigation is sufficient I'll switch back to the control center toggle.
(Not for nefarious/tracking reasons.)