I wouldn't say that I'm missing the point. While it is unfortunate that the version they were planning to upgrade to didn't fully resolve the issue, code upgrades are and will always be part of maintaining a system such as this. This isn't the last oil change. It sounds like Cisco realized and announced the issue with that version of code pretty quickly. It seems it may even have been in time to ensure that you still only have to do a single downtime to upgrade the code. But a month from now, when the next researcher discovers an issue with the WLC or there is another bug is OpenSSH or OpenSSL which will require a code upgrade, you'll have to go through this process again.
We as engineers/admins are limited to the information that is provided to us from the vendor. It sucks at times, but in this case, I think Cisco identified and communicated the issue with the 8.3 train fairly quickly. The initial public report about the KRACK issue came from Cisco on 10/16. "Fixed" code was made available about a week later. We are currently about 2 1/2 weeks post vulnerability announcement, and they have made fixed versions available for almost every code base (8.6 still didn't have one that I could find).
I can appreciate you have concerns about how this is perceived by the customer, but it's not like you had better information at the time and provided them bad information. Also, keep in mind, there are 10 parts to the KRACK vulnerability, and 9 of them are client side. Microsoft already patched the windows side stuff in the October updates before the issue was made public. There is a reason that it has been assigned a Cisco assigned it a base CVSS of 4.3.
KRACK is high profile and a concern, but depending on your environment, doesn't need immediate remediation. Arguably it could wait until a regular maintenance window/upgrade cycle.
There is no guarantee with any upgrade. Look at the release notes for ANY software. The only thing you can do is validate the source of the information as much as possible, do some research, read the release notes, evaluate the issue, make a decision, test it if possible, and have a backup.
Good luck whatever you decide.
