How secure is the E0 stream cipher used in Bluetooth? The question is about E0, the stream cipher used to secure Bluetooth communication. The impression I get is that it's more secure than A5/1. Also, why wasn't AES used instead?
Bluetooth has gone through a few transitions in protocol.  Bluetooth BR/EDR uses E0/SAFER for a cipher and Bluetooth LE uses AES-CCM.   Fundamentally, when you write a specification as an engineer, you are looking for a minimally viable CMOS implementation.  You make choices that are not always the best from a cryptographic standpoint because you have space or power constraints.  For instance, AES is rather large compared to some stream ciphers and I believe the motivation of using E0 was die space because LFSRs are smaller than an AES implementation.  I personally use SIMON over AES in hardware because it's smaller, faster and lower power in a CMOS implementation, and this is particularly true when you are encoding a "bit stream", such you'll have in RFID or Bluetooth. 

I know from being in a meeting that FIPS-140 validation for Bluetooth was an important conversation with the Bluetooth LE spec, which is why AES was added.  I can only assume that AES was not used in the original ICs due to cost on the hardware side.  Looking at 130nm dies (so, back in the day), AES would cost me about 0.03 USD in area.  Just by guessing the area of E0, I would say it's 0.01 USD, so it must have mostly been an economic consideration during the time of early adoption.

E0 itself is not particularly secure and is vulnerable to known plaintext attacks.