Is it possible you're paired in Mac OS system settings? That could definitely do it.
I had killed all pairings, so didn't think it could be that. However, I tracked down what was up:
I had a chrome window open somewhere from a few days back with the IDE loaded. It or the web BLE stack must have been hanging on to the device whenever it saw it turn up! So kill that and it is working as expected now.
On the BOOTING comment, yes, assume that is working fine, just didn't match the docs. I updated a 2v04 to 2v05 in the process to check, and all continued to work fine which helped confirm it was likely client side.
The NRF.getSecurityStatus().connected call is working fine too, and disconnect() logic is not needed now I understand the correct behaviour is it to disconnect anyway.
Thanks for your all your help!