Using the WPS (Wi-Fi Protected Setup) button is generally considered a secure method. For two minutes after that, your access point will accept new devices onto the network, but not after, which means that the scope for attack is limited. If you are concerned, most access points allow you to find the connected devices to your network, and you can verify that before and after only one new device has connected.
The WPS PIN method is known to be vulnerable to brute force and should generally be disabled on all access points. However, you're clearly not using that technique here.
If you're using the Wi-Fi network of the extender, that is also probably okay, provided you promptly secure it with a strong password you don't use elsewhere. The use of HTTPS is generally not possible on this kind of device because (a) certificates are time-limited, so they could expire before your device got installed, and (b) usually there isn't a secure way to ship the private key required for TLS, so the certificate would end up revoked due to potential misuse.
I generally recommend against using custom apps for setting up embedded devices because typically the security in such scenarios is pretty abysmal and using the app may result in that functionality being enabled on a more permanent basis.
The major threat you need to consider in scenarios 2 and 3 is whether the attacker is present in the small window of time during your power-on and setup. If so, all of these options are insecure, and you should return the device and purchase one that does not power on any radios until set up over an Ethernet connection so that you can secure it adequately at first from a trusted network. You will also of course want to be sure that your network is secured with a passphrase providing at least 128 bits of entropy and that all of your extenders and access points are up to date with security patches.
If, on the other hand, you believe that your major source of attacks is going to be nosy neighbors and not a dedicated, ever-vigilant party, then option 2 is probably secure and also quite easy, and it's a fine choice.