If you are with your phone out of the house and you have wlan enabled. Your phone is screaming out to world i'm looking for the wlan with the name "yourhomewlanname". If someone has the router equipment, he can easily say he's the router and just throw away the password and route all traffic through his router. This is a massive security hole!
Why is this not yet removed?
The next thing is WPS System here is described how horrible this is it.
The third thing is that you can sent deauc to any device and it will automatically reconnect, you can capture the handshake, and try to decrypt the handshake locally!! If the password is not in an dictionary or long enough, this doesn't matter. But still that you can try it locally is not the best design, since you can use arbitrary many machine power to decrypt it. If you had to use for every combination the interaction with the router this would be much more limited.
After all that, i am really asking myself. Why do people invent things like WPA2 and then implement the rest so weakly?