OP is right though. As far as the onion is concerned you better add more characters to the security pass-phrase, also make sure WPS is disabled on all routers etc.
Once someone has determined to break in, even minimally sophisticated they will spoof the mac address. It is good that you want to add extra security, but even as your story shows it just creates confusion, and make using the system harder.
Those decisions come the people in the glass room in the security office. Not much I can do to change global security policy.
I understand, it was more of a comment in general, or maybe the glass room people would stop by and read too ;-)
We look at security as one would look at an onion.