The flaw isn't in zigbee persay, but more in how manufacturers are implementing it. In their desire to have easy interoperability, they are allowing attackers the same ease of access. Not unlike early ICQ where spoofing was easy and rampant.