setSecurity not working as expected

Sorry about that, there was a problem with the build - try now and it should update ok:

http://www.espruino.com/binaries/travis/master/

It's possible that you just won't get notifications on the characteristic? What happens if you try to read it?

You could also try adding 'write':

security: {
        read: {
          encrypted: true,
          mitm: true,
          lesc: true,
          signed: false
        },  write: {
          encrypted: true,
          mitm: true,
          lesc: true,
          signed: false
        }
      }

It's possible that what's happening is the characteristic is still allowing writes which allow you to turn on notifications - that's something that should probably be fixed in firmware (to automatically stop writes if read is set to require encryption).