The question is not whether there will be an exploit but what will be the range of upcoming exploits.
This vulnerability receives so much attention precisely because of its impacts.
Would it be a theoretical weakness reserved to potential state agency or a thing easily fixable as part of automatic update processes, nearly no one would have ever heard of it outside of the IT-Sec world.
But the real question in such situation is: what's next?
Once a security flaw is published, it attracts a worldwide attention to a specific piece of code, usually resulting with other flaws being found or other ways to use the discovered flaw with more impact or efficiency.
Simply look at the flaw discoverer, Mathy Vanhoef: between the time he wrote his paper and the time he publishes it he himself discovered new techniques making some attacks significantly easier than what he initially thought.
So bring this to a worldwide scale, and you understand why Mathy chose to end
his KRACK Attack page as follow:
So you expect to find other Wi-Fi vulnerabilities?
“I think we're just getting started.” Master Chief, Halo 1
If you remind of the WEP total failure, the issue was not to be found in a single security issue but in a series of several flaws:
- It is possible to replay some packets.
- Some cryptographic initialization may be reused.
- The encryption strength is limited.
Taken alone, they are not very powerful. But associate them, using the replay attack to force initialization vector to be reused and allow to break the encryption key, and WEP becomes fully broken with war-drivers roaming across streets.
Here we have one flaw affecting the WPA2 protocol. It is already very impacting and, as you said, a large proportion of devices will never get patched. But will this stop at this (WPA2 being better engineered than WEP we might hope so), or is it the first discovery of a dark series affecting the WPA2 protocol? No one knows for now, and a lot of people are working on this.
KRACK: will there be an exploit soon?
Yes, and yes it will have the impact you describe, and not only that new discoveries may potentially make the situation even worse.