I figured it was a matter of time before this was exposed. The pins are usually 8 digits which it has been known for quite some time that you need at least 12 sufficiently random characters for any kind of protection against brute force attacks. Of course the lack of a lockout system makes it even more trivial.
WiFi Protected Setup Flaw Can Lead to Compromise of Router PINs | threatpost.