The vulnerable link is the air between devices
A Bluetooth call is a live radio exchange: the phone sends the caller’s voice to the earbuds, and the earbuds send microphone audio back. Encryption scrambles that exchange so that nearby receivers cannot readily make sense of it. If a particular connection carries audio without encryption, someone within radio range may be able to capture intelligible call audio instead of merely detecting that devices are communicating.
The risk depends on how the devices establish and protect the connection. Pairing—the process of connecting earbuds to a phone—does not by itself prove that every later audio stream is encrypted. The protection has to be active on the link carrying the call.
Eavesdropping is only one possible consequence
If an attacker can inject audio into a vulnerable stream, a phone’s virtual assistant may hear it as a spoken command. That could let the attacker try to trigger actions the assistant accepts by voice. This is not the same as taking over the phone: what happens depends on the phone’s settings, what commands it permits, and whether the audio path can actually be manipulated.
These conditions matter. The warning does not mean that ordinary Bluetooth calls are automatically exposed, or that every pair of earbuds has this weakness. The practical question is whether a specific device connection leaves its audio unencrypted and accessible to someone close enough to interact with the radio link. When it does, a call meant for the wearer can become an input or output channel for a nearby attacker.
