There are two (main) modes in which to run WPA2. You can use enterprise mode or pre-shared key (PSK) mode.
If you run in enterprise mode you need to set up an authenticating RADIUS server, and configure certificates on the clients that will connect to the access point. Furthermore you need to configure the AP will all the relevant information. This level of effort is well beyond the abilities of a typical user.
WPA2-PSK mode uses a pre-shared key that both the client and AP know. This is the password, and simply using a password is within the technical abilities of most users. The password is never actually exchanged when a client connects to an AP. Instead there a is a four way handshake that occurs. Through this process the client can prove to the AP that it knows the PSK.
WPA2-PSK is not really insecure. Instead I would say it's vulnerable to a brute force attack. If an attacker can capture a 4 way handshake (a trivial task) they can run that handshake through a dictionary in order to derive the PSK. This is the key part. Just like with normal password hashes long, complex passwords are they key to making the brute force attack un feasible.
As a final note: WPA2-PSK networks are "salted" with the name of the AP. Rainbow tables exist with precomputed hashes for the most common AP names that exist (think "hilton-hhonors", "starbucks" etc). A way to get a unique salt (and thus defeat the rainbow table) is to have a unique AP name.
Edit: If you're curious about what a "good" password length then is if you have to use PSK? According to IEEE 802.11i (the amendment that details WPA2)
A pass-phrase typically has about 2.5 bits of security per character, so the pass-phrase mapping converts an
n octet password into a key with about 2.5n + 12 bits of security. Hence, it provides a relatively low level of
security, with keys generated from short passwords subject to dictionary attack. Use of the key hash is recommended
only where it is impractical to make use of a stronger form of user authentication. A key generated
from a pass-phrase of less than about 20 characters is unlikely to deter attacks*.
*Emphasis mine. However keep in mind 802.11i was published in 2004. Computing power has since changed. I would still agree though that 20 characters is pretty good.