I think, ripple in S21 measurement is a different problem (not ideal 50om matching of the output port reflections between DUT and ouput port), it can be solved as you say, by adding 6 or 10dB attenuator between output port and the measured device. Idealy, we can build 10dB wideband power amplifier 10dB attenuator, this will make both thing together - it makes better 50om matching and doesn't drop signal amplitude.
Poor isolation is a different thing, I beleve it comes inside the KC901V, in the RF switch, which directs signal to either port1 or port2.
This signal leakage is stable, and it won't change its phase. That's why I think it can be compensated in software. 2017-11-10