So, while you could store the admin password hash, the router does need at least the WPA PSK to implement the protocol (see my reply to smtddr for more details)

So, while you could store the admin password hash, the router does need at least the WPA PSK to implement the protocol (see my reply to smtddr for more details). What they could do, if they really wanted to be clever, is store a hash of the admin passphrase (which won't help anyone auth to the router) and store an encrypted version of the WPA PSK under a key derived separately from the admin passphrase. Then, after the restore, you would require the admin to log in before the access point portion is turned on. When the admin logs in, rederive the encryption key, decrypt the PSK, and enable the access point. It's a slightly degraded user experience, but it does have nice properties.