I've searched for quite some time, but all i find is that "Deco units don't have the WPS activated unless you press the button on the app" but a lot of fórums say otherwise including this one. I could test it an see that WPS is always activated on these units with a simple Android app, this is a big security risk.

Tp-link is great and i believe that a simple update would solve this problem, i know Deco is a product for people that want simplicity but nothing explain why don't put a simple option like this one.