How does macOS Sierra securely pair with Bluetooth keyboards without a code?

TL;DR answers to questions

How does macOS validate and secure connections between Bluetooth keyboards without prompting for a code?

It's not just macOS - your keyboard is connected and encrypted at the firmware level - if it wasn't you wouldn't be able to perform an NVRAM reset before the OS loads.

However, you don't need a code because modern Bluetooth keyboards use an authentication algorithm to pair and a generated authentication key based on public keys to secure the data transmissions.

Does it just use trust-on-first use?

No. It verifies its identity using an algorithm and 128-bit generated keys.

Is it possible to force macOS to use a pairing code?

Why? This would be going back to pre-2009 pairing methodologies. This would be the equivalent of enabling WEP shared keys on modern WiFi networks.

Bluetooth Pairing

The process you described for pairing a Bluetooth device (a keyboard in your example) uses an old (Bluetooth 2.1) method of authentication called Simple Secure Pairing (SSP).

Basically, SSP has 4 association (pairing) models:

• Numeric Comparison. Both devices have input and display so the user can simply select "Yes" or "No" to pair the device
• Passkey One device has input capability (like a keyboard) and the other has display capability (like a computer). The device with display capability shows a 4 to 6 digit number and the device with input capability enters it.
• Just Works This is for devices with no display or input capability (like headsets) where you can't see or enter a passkey.
• Out of Band (OoB) This is for devices that support an additional common wireless technology (NFC) where the devices have to be in very close proximity to each other. One device must "tap" the other device before pairing will occur.

The most important thing to note is that SSP is NOT the encryption key; it's merely the pairing mechanism to identify each other. Encryption is handled through a public key. The code you enter is to make sure that's the device you want to connect to; it's not the security.

Since Bluetooth 3.0 (April 2009), Bluetooth devices uses an AMP key for authentication which automates the above process.

AMP Key Derivation AMP link key is derived from the Bluetooth link key. A Generic AMP Link Key(GAMP_LK)is generated by the AMP Manager in the host stack whenever a Bluetooth link key is created or changed

Authentication

The Bluetooth device authentication procedure is in the form of a challenge–response scheme. Each device interacting in an authentication procedure to as either the claimant or the verifier. The claimant is the device attempting to prove its identity, and the verifier is the device validating the identity of the claimant. The challenge–response protocol validates devices by verifying the knowledge of a secret key — the Bluetooth link key.

Encryption

There are 4 modes of encryption

• Mode 1 - No encryption
• Mode 2 - Individually addressed traffic is encrypted based on keys which are based on the link keys
• Mode 3 - All traffic is encrypted using keys based on the master key
• Mode 4 - (Bluetooth 2.1 + EDR) mandates all traffic is encrypted except for service discovery

Bluetooth keyboards using Bluetooth 2.1 (keyboards from 2009 and beyond) and up encrypt all their traffic.