An attacker can just dump the unique key, impersonate the device and use that for a MitM attack. There's just no way to do this securely without completely lock

An attacker can just dump the unique key, impersonate the device and use that for a MitM attack. There's just no way to do this securely without completely locking down the devices using hardware key management (which would be unreasonably expensive for a cheap router, plus bad for people who want to flash their own firmware). Same level of security, and a lot of extra complexity and cost.