It’s always been my working assumption that WiFi security should be presumed to be broken until it is proven to be broken.