Ok.. So this is how the grants work..
If you leave the defaults which usually includes S0 it won’t use S0 for hub communications.. It uses the highest common grant.. So the hub has all the keys and as such will always use the highest grant that the device has. But if you use direct associations is where the lower security grants come into play.. So if you have a S2 authenticated device trying to talk to a S0 only device and you didn’t grant that S2 device a S0 key, then they can’t talk direct through associations.
