Broadcom says it fixed this 16-year-old Wi-Fi flaw in 2018, but the fix never reached the routers, and attackers in range need no password