I have yet to see a real case of "binary blob for regulatory reasons". What law prevents open source RF firmware?

The device needs to operate in spec and if someone reflashes it with out of spec firmware, that's no different than someone soldering a different resistor onto the PCB or feeding the output of the chip into an amplifier and large antenna. It's a modification by the user and so the user is liable for operating out of spec. And all of this really unrelated to source code, just to reflashablitiy. The code could easily be open, but the productions device could be made unflashable if the law really required it. Yet this is not what we see here.

It's IP reasons, and that's fine, but let's not make up additional excuses for them.

Zephyr provides an open source implementation of all layers of the BLE stack. The radios of some devices are documented extensively, Nordic nRF5 devices are probably the best example.

The Bluetooth SIG requires that you qualify your device if you advertise that you use Bluetooth IP, similar to what is required for the cellular space. Do you have to do this if you’re just “Bluetooth compatible?” Maybe not. Whatever the case you have to conduct FCC part 15C testing (intentional radiator).

I understood the criticism to be about describing it as open source when it isn't, i.e. that

"We say it's open source because we expect the reader to know that we're not telling the truth"

should be replaced by

"It's open source except for the BLE firmware blob, which can't be open source due to regulatory reasons."

To be fair, the article just repeated the claims made on the GitHub page for the SDK.

I know very little about bluetooth firmware beyond using it for apps and such, but what kind of regulatory reasons are there that prevent publishing source code for bluetooth radios?

Not in Zephyr. There's a full BLE Controller in source code form there.