A flaw in WPS is that you can crack each half of the 8 numerical digits independently (2x 4 numerical digits are much easier than 1x 8 numerical digits). Y
However, since the flaw was discovered, why not apply a patch and only send a response if and only if the client has the whole password right? Implement a time-out and your router is secure for the next 1,000 years.
But why is the hole still open?