WL_WRONG_PASSWORD, was defined in wl_definitions.h, and had nothing to do with what was set at the access point (AP aka router), at least in core version 3.0.2. The function behind WiFi.begin was meant to return WL_WRONG_PASSWORD if the pass phrase exceeded 64 chars.
The expected behaviour with a well written sketch, but using a 'wrong' pass phrase, is WiFi.status() == WL_DISCONNECTED. Fairly easy to test, with for example the OP's nearly complete code above.
For more in depth understanding, try https://github.com/esp8266/Arduino/ then use the search tool to find references of interest. Happy reading.