I did a scan of all the AP's that I can see with my laptop and ALL 10 or so had the WPS unlocked meaning that If I wanted to I could get the passphrase for all the networks. Very scary indeed.
I couldnt scan my AP for some reason as I was getting frame errors...hopefully that means no one else can scan it either.
If I get a chance I will take my CGN2 out of bridge mode and test it and report back.