The attacker gets a Man in the Middle position on layer 2 (data link). So every step in the handshake goes through the attacker. The attacker couldn't just Mit

The attacker gets a Man in the Middle position on layer 2 (data link). So every step in the handshake goes through the attacker. The attacker couldn't just MitM the protocol on layer 3 as it cannot authenticate with the WiFi router. Of course, the attacker already could just pretend to be the wifi router and then forward and inspect all traffic to the internet. What is scary here is that it breaks into a Local network as opposed to the internet.