Thanks @Marvin_S 

A TP-Link support engineer has responded and acknowledged that:

"For wired LAN clients, they are indeed discoverable and the guest network in AP mode is currently designed not to be isolated from wired devices."

Whoohaa! So un-ticking  "[  ] Allow guests to access your local network" does NOT mean that Guest Clients are not allowed to access wired clients on the local network - one could ask - what does it then mean??

If the statement from the support engineer holds true then the above setting text is very very confusing - in my world local network does indeed include wired clients connected to the LAN switch - otherwise why have this setting at all - especially because the following other two settings should have taken care of isolating all WiFi Clients from each other:

[  ] Allow guests to see each other. - (meaning that no WiFi Guest client should be able to address other Guest Clients !!)

[+] AP Isolation - general WiFi setting relevant for all WiFi clients (meaning that no WiFi client should be able to address each other!!)

All very relevant settings - but in my Ethernet Backhaul setup (with two AX55 acting as Access Points) the settings have absolutely no effect.

Anyway they also told me that they need more time to investigate further (fair enough) - I suspect they need to check if the Ethernet Backhaul interface is actually allowing all WiFi clients (main / guests) to address each other like they were all on the same switch. The answer will be exiting - especially because I suspect that the Ethernet Backhaul code-base for many of TP-Links products are more or less identical - and hence the effect of a logical flaw in this module would be substantial.

I'm sorry to say that it seems like the most important part (wired LAN isolation) is not something TP-Link thinks is very relevant but I'll await further feed-back from Engineering Support and keep you updated in case more relevant info appears.

Best regards

zEnterHacker