Access Control on CAX30 doesn't work

I just got this router and set it up. I'm able to connect to the wifi and access the internet just fine. Device came with firmware version 1.4.something (I updated it later, don't remember the exact version). I enabled access control for extra security by going to the Access Control tab, turning on access control, and selecting "block all new deviced from connecting". And hitting apply, of course.

However, when I activated the access control and set it to block all new devices trying to connect, I noticed that devices could use the internet for around 30 seconds before being blocked. I consider this a security risk.

I expect access control to prevent a device from connecting to the network at all unless it has a mac address in the access list (like on my old WNDR4500 router)

I updated the firmware to V2.2.1.12 and now the access list doesn't work at all. I connected my desktop to the wifi and am able to browse just fine without adding it to the access list. The device is showing up in Attached devices as an allowed device, but nowhere in the Access list.

Did I set up the access list wrong? Or is the access list notoriously broken on this device?