Espressif markets the ability to send Wi-Fi credentials to a device via BLE as "BluFi". This ability is advertised with the 16-Bit Service UUID 0xFFFF.
My understanding is that all 16-Bit BLE Service UUIDs are reserved for standardized BLE services. Although the BluFi Service UUID doesn't currently cause a conflict, should this still be considered a violation of the BLE standard?
BLE assigned numbers: https://www.bluetooth.com/specifications/an/
BluFi: https://docs.espressif.com/projects/esp-idf/en/latest/esp32/api-guides/blufi.html
If we look in that Assigned Numbers document you link, we can find this:
Following that reference, we find:
Note that this section is located in the SDP chapter, which is usually not related to BLE or GATT. However, this section applies to the ATT protocol as well (which is used by GATT), as indicated by the 3.2.1 section in the ATT chapter.
That said, my interpretation is that all 16-bit and 32-bit UUIDs are already allocated to be used for registered purposes. Note that all these UUIDs allocated may not yet have been assigned a purpose and should therefore be reserved for future use.
This is further confirmed in the "Vol 1, Part E: General Terminology and Interpretation" chapter of the Bluetooth Core v5.4 standard:
Since a 16-bit service with UUID 0xFFFF is not present in the Assigned Numbers document, it appears they are indeed violating the standard.
Furthermore, according to https://support.bluetooth.com/hc/en-us/articles/360062030092-Requesting-Assigned-Numbers, it is not possible to register a member specific 16-bit Characteristic UUID (only Service UUID). Despite this, BluFi still uses Characteristic UUIDs 0xFF01 and 0xFF02.
My bet is that they used these short UUIDs during internal testing and then forgot to replace them or forgot to purchase their own 16-bit UUIDs at release, and nobody noticed this mistake.