The summary has the bug, from the user perspective. The reality is that bluetoothd already has code to remember the powered state of the adapters, but we're overriding it from the session, and talking to /dev/rfkill directly.

My idea thus is to add a bluetooth_applet_is_device_powered() / bluetooth_applet_set_device_powered(), and have the shell switch affect that.
BluetoothKillswitch would stay, but only for reading and unblocking (in particular for exposing the hard blocked state).

I'm not yet preparing a patch, because I'm not sure this makes any sense, and surely you know better.