Once a device is bonded, pass --device-db on later connections to the same device. You do not need to pass --pair or --bond.
For example:
nrfutil mcu-manager ble --hci-serial-port COM35 --device-db bonding.db image-list --device-name Nordic_LBS
nRF Util looks up the stored keys for the device address and automatically re-encrypts the link after connecting. The command output shows steps similar to the following:
v Device found: F9:9F:F3:7E:B3:D6, Nordic_LBS
v Connected to device: F9:9F:F3:7E:B3:D6
v Re-encrypted link with F9:9F:F3:7E:B3:D6
If re-encryption fails because the peripheral no longer has the bond (for example, after a factory reset), remove the stale entry from the device database using the mcu-manager ble-database command and pair again.