A new NetRise review finds unpatched WPS implementations let attackers recover PINs offline despite years of supposed vendor support.