To elaborate on that a bit …
Because the switch is basically cutting power to the card, there really isn’t a way of simultaneously getting the certainty of a Hardware Kill Switch and the flexibility of separate control over WiFi as distinct from Bluetooth. You cut power - you lose both.
The only way of doing it would be to have two slots, two Hardware Kill Switches, two cards (i.e. one extra of each) and to source a supported dedicated WiFi card and a supported dedicated BT card - but that is not what is available.
So if you want separate control then you have to enable/disable in software.
That is absolutely the intention of the design.
You are free to order without a card, or to order with a card and then physically remove it - for certainty that goes beyond even a Hardware Kill Switch.
You are free to order without a card, to source your own card and to install it. Of course then you take responsibility for getting it working, and you will need to be careful to understand what blobs, if any, are needed in order to get the card working - and to decide whether that is important to you.
Looks like M.2 but bear in mind that M.2 can be keyed in various ways.
M.2 itself potentially offers both PCIe and USB electrical interfaces (and indeed other interfaces, like SATA, all depending on the keying), and it is not uncommon for combined WiFi/BT M.2 cards to do the WiFi over PCIe (for the higher speeds) and BT over USB.
M.2 form factor is a separate question. It would be difficult to answer that without seeing the insides. You may need to ask Purism at
email@example.com but I would guess 2230.
Of course, if you order without the WiFi/BT card, you also have the option of using an external USB WiFi dongle, which has advantages and disadvantages.
It depends on what your goal is.
If the goal is to avoid Bluetooth then many people would be happy to disable in software. Maybe you can completely remove the Bluetooth support in software, on the Linux side (and not just disable).
As the previous reply says, Bluetooth doesn’t work out-of-the-box anyway (for other reasons) so it depends on your level of paranoia.