It's a pity this didn't completely break WPA2 like how WEP was broken, now it will be years before there's any new security developments. Things like management frame authentication and dynamic client keys for open networks would be big improvements for the majority of use cases.
The problem is that tons and tons of devices will not receive update until they die.
Don't you only need to patch one end of the communication? Eg if phones are patched, they're safe, even if the AP is not. Then again, I didn't read the attack fully, this might be a client-only problem.
Tons of phones won't be patched. Android phones generally only get system updates for a small portion of their lifespan.
You can mitigate with a vpn.
How do I install a VPN on my IoT lightbulbs?
My understanding is that only the light bulb's traffic will become decrypted. If you see it go from blue to red, without your consent, then you'll know. Otherwise, the Wifi password is still safe.
How many BT and Virgin home routers will be patched? Somewhere around 0?
Both Virgin & BT force upgrade consumer routers overnight.
Latest Virgin upgrade was a year ago, so I'm not holding my breath...
Mine last updated a couple of months ago, around the end of August. (V2.01.12, superhub2ac)