@VirsT 

Can i get somewhere clean conf.bin file for backup? 

it would be best if the settings were the same as in the emulator because there are no strange networks there:

(https://emulator.tp-link.com/Archer_VR400(EU)_V2/index.htm)

  @VirsT 

I didn't find a clean conf.bin file but I found a way to edit my own :D and i did it! i deleted <Enable val=1 /> and now those hidden networks are gone.

<X_TP_MultiSSID>
          <MultiSSIDEnable val=1 />
          <MultiSSIDEntry instance=1 >
            <Name val=wlan1 />
            <SSID val=TP-Link_Guest_4C7B />
            <SSIDAdvertisementEnable val=1 />
            <BeaconType val=Basic />
            <WEPKeyIndex val=1 />
            <BasicEncryptionModes val=None />
            <BasicAuthenticationMode val=None />
            <WPAEncryptionModes val=TKIPandAESEncryption />
            <WPAAuthenticationMode val=PSKAuthentication />
            <IEEE11iEncryptionModes val=TKIPandAESEncryption />
            <IEEE11iAuthenticationMode val=PSKAuthentication />
            <RadiusServerPort val=1812 />
            <WEPKey instance=1 >
            </WEPKey>
            <WEPKey instance=2 >
            </WEPKey>
            <WEPKey instance=3 >
            </WEPKey>
            <WEPKey instance=4 >
            </WEPKey>
            <WEPKey nextInstance=5 />
          </MultiSSIDEntry>
          <MultiSSIDEntry instance=2 >
            <Enable val=1 />
            <Name val=wlan2 />
            <SSID val=TP-Link_A24C7B_01 />
            <BeaconType val=11i />
            <WEPKeyIndex val=1 />
            <BasicEncryptionModes val=None />
            <BasicAuthenticationMode val=None />
            <WPAEncryptionModes val=TKIPandAESEncryption />
            <WPAAuthenticationMode val=PSKAuthentication />
            <IEEE11iEncryptionModes val=TKIPandAESEncryption />
            <IEEE11iAuthenticationMode val=PSKAuthentication />
            <RadiusServerPort val=1812 />
            <WEPKey instance=1 >
            </WEPKey>
            <WEPKey instance=2 >
            </WEPKey>
            <WEPKey instance=3 >
            </WEPKey>
            <WEPKey instance=4 >
            </WEPKey>
            <WEPKey nextInstance=5 />
          </MultiSSIDEntry>
          <MultiSSIDEntry instance=3 >
            <Name val=wlan3 />
            <SSID val=TP-Link_A24C7B_02 />
            <SSIDAdvertisementEnable val=1 />
            <BeaconType val=Basic />
            <WEPKeyIndex val=1 />
            <BasicEncryptionModes val=None />
            <BasicAuthenticationMode val=None />
            <WPAEncryptionModes val=TKIPandAESEncryption />
            <WPAAuthenticationMode val=PSKAuthentication />
            <IEEE11iEncryptionModes val=TKIPandAESEncryption />
            <IEEE11iAuthenticationMode val=PSKAuthentication />
            <RadiusServerPort val=1812 />
            <WEPKey instance=1 >
            </WEPKey>
            <WEPKey instance=2 >
            </WEPKey>
            <WEPKey instance=3 >
            </WEPKey>
            <WEPKey instance=4 >
            </WEPKey>
            <WEPKey nextInstance=5 />
          </MultiSSIDEntry>
          <MultiSSIDEntry nextInstance=4 />
        </X_TP_MultiSSID>
        <X_TP_WlBrName instance=1 >
          <IfName val=wl0 />
          <BridgeName val=br0 />
        </X_TP_WlBrName>
        <X_TP_WlBrName instance=2 >
          <IfName val=wl0.3 />
          <BridgeName val=br0 />
        </X_TP_WlBrName>
        <X_TP_WlBrName instance=3 >
          <IfName val=wl0.4 />
          <BridgeName val=br0 />
        </X_TP_WlBrName>
        <X_TP_WlBrName nextInstance=4 />

last question, can I somehow completely remove this <MultiSSIDEntry instance=2 > and <MultiSSIDEntry instance=3 > code or edit it, leaving only the guest network?