As noted in the original post, the reset button does not work-- at least not in v5.1-v5.2. If you search the forums, you'll see that others reports the same experience. Additionally, the Discovery Tool cannot find my device with v5.1 firmware. Fortunately, the v5.1 device was likely a spare that had never been put into service. It turns out the default password was 'admin123' instead of the expected 'motorola'.
I was able to recover the remaining devices with the Discovery Tool. At this point, the VC rescue method is just an academic curiosity.
I'm guessing they make these wallplate APs difficult to reset to avoid tampering. They are typically installed low to the ground and there's only one screw blocking access to the reset button. Ironically, once the plate is removed you have the MAC address for spoofing the POE Ethernet connection. There's really no security.