How many MAC addresses does the series 7 Orbi have?

You are entirely correct.  All of those mysterious MAC addresses are variations on the primary MAC address.

One issue in researching WiFi channels is that most tools are designed to identify Access Points (APs), not user devices.

The  Orbi router broadcasts SSID's on these (6) channels:

Primary WiFi - 2.4G and 5G

Guest WiFi - 2.4G and 5G

Backhaul - 2.4G and 5G (This SSID is not broadcast, but is very much "there"  Mine is named NETGEAR_ORBI_hidden41

Each Orbi satellite broadcasts SSID's on these (4) channels:

Primary WiFi - 2.4G and 5G

Guest WiFi 2.4G and 5G

In addition, each satellite communicates to the router on the 5G channel (or the 2.4G channel if 5G fails) using a contrived MAC address.

Those WiFi Analysis tools do not pick up this MAC address because it is not an AP.  It is a device communicating with the router AP.

So, if the system consists of one router and three satellites, there will be a total of 6+4+4+4 = 18 access points plus three 5G MAC addresses for backhaul.

On the original Orbi models, there is a web page "hidden_info", i.e. http://<ip of orbi>/hidden_info.htm that reveals this information.  (It is not clear to me whether the AX models have this web page or not.  I don't have one to test.)

My favorite tools for this sort of thing include:

• WiFiInfoView (Windows - free)
• WiFi Analyzer by Kevin Yuan (Android)
• Wireshark (Linux and Windows)  This is what discovered the 5G MAC used for satellite backhaul.  Filtering the Wireshark display by the MAC address I knew about showed these other MAC addresses sending packets to the backhaul Access Point MAC.

Is this the sort of information you were seeking?