The API user does not get much feedback if pairing fails and using BT_SECURITY_HIGH might be a bit too much. While Encryption issues require BT_SECUIRY_HIGH authentication does not require such a high level of security.

LBNL if the pairing fails the ATT stack remains locked as the pending security request is not cleared from the ATT queue. Some form of timeout is required.