Today I discovered that the Device Isolation settings of the main router are not working for isolated devices that connect through the satellite router.  Using a laptop (an un-isolated device) connected to the main router via Wi-Fi, I am unable to ping or open any web interface of an isolated device.  That is the way device isolation is supposed to work.

When moving the laptop and then connecting to the satellite router via Wi-Fi, I can now ping and open any web interface of isolated devices that are also connected to the satellite router.  In other words, the satellite router is not using the Device Isolation settings of the main router.  I consider this a security bug.

If my memory serves me correctly, in previous configurations (before EasyMesh), devices that connected to a second router working in AP mode behaved this way also.  However, in EasyMesh, this should not be the case.  EasyMesh satellites do not extend the guest and IoT networks and all devices must use the main SSID(s).  A device that "roams" between the main router and any satellites should not be able to circumvent the device isolation settings.  In the case of an un-isolated device (such as the laptop mentioned earlier), this is not a big concern.  However, with an isolated device (such as a Roomba), this might pose a security concern.  The bottom line is that any isolated device in the main router should not be able to connect to the rest of the network when connecting through a satellite EasyMesh device.