Sorry to dredge this one up, but FurryNutz, after your excellent as usual explanation and answer, I'm still not sure I understand which is the safest setting for WPS PIN - it should be LOCKED, correct? Wording is strange to me. Wish it was just a simple, clear "enable/disable" choice. I'm on firmware version 1.20, but I don't think that matters here.
Thanks as always for your help.