By further researching, the issue is that bluetoothd doesn't add OBEX profiles to the controller capabilites until obexd starts, which happens only at KDE login (as obex needs D-Bus etc).
So if bluetoothd is restarted manually after login, it picks up OBEX and everything works. The bug #1123793 in bluez is probably related to it.
signature.asc
Description: This is a digitally signed message part.
