They already have ways of effortlessly connecting wireless clients to certain routers, so I don't see why they couldn't do something similar with another router and it could still be secure. You could simply press a button on the two routers and have them pair with each other, with no need for NFC, which would add a lot of cost for something you'd rarely use.
This is similar to one of the reasons I got rid of my X10 system. With X10's RF transceiver, there was absolutely nothing stopping anyone with a remote from turning my lights on and off. Well, nothing other than 16 different house codes, but that could take no more than a minute to figure out. Z-Wave products, which I have now, create their network by putting the central remote in pairing mode and pressing a button on the Z-Wave device. From that point all the devices are in a mesh network and communicate with each other until they all get the signal.
Dan, while I think what you're proposing is possible, there's one thing I'm having trouble thinking of a way to get past: WDS. I don't know how you'd add a second wireless access point to a home network without using WDS, whether the user had to set it up or not. This would mean halved performance for anyone connecting to the second access point. That is, unless this access point had two radios in it, with one handling the connection to the main router and the other handling connections. That would add cost, though.
In the end, you can get a router that's supported by Tomato online for under $50, and I guarantee you can make a router get to that top floor of his home. No, it's not easy to do for the novice, but that's when you get a friend like you to set it up, or hire someone like me who comes to your home to do it for you
