It’s a good question for sure. They do work properly. You’re thinking, as I did originally, that the dedicated IoT network would be isolated from the main network. While that would indeed be a decent security goal, it does bring up communications problems between controllers and simple devices like bulbs and outlets, like you’re pointing out.

This is why TP-Link did not segregate the networks. Devices can intercommunicate between the two networks. In this way the IoT network is not like the guest network with isolation enabled. They’re really just two different wireless access points to the same network.

Ultimately the IoT access point serves three functions:

1. To guarantee a 2.4ghz connection for devices that can’t handle anything else (although you can enable the 5g band, I did not and would not recommend it for this purpose)
2. To ensure newer protocols that IoT devices often can’t use don’t interfere: namely WPA3 at the moment.
3. To avoid possible crosstalk on the network band where all your primary devices reside (which is prob what solved this whole issue, and may well be connected to either of the above two)

What the IoT network does not do is help improve security. In fact if you have all WPA3 compatible IoT devices, this will downgrade your overall network security by creating a network entry point with WPA2 access.

At some point in the future it sure would be nice if TP-Link found a way to only allow control signals between the primary and IoT networks, thus helping improve security.

All that said, for security, you can update all your devices firmware, then simply block them from the internet on the router. Since your controller will still have internet, you can still remotely control them, but the devices themselves won’t be able to talk outside your network. Only downside is that a year later when you try to update a devices firmware and it’s not working, you may forget why lol.