Yes and no.
Yes, it is normal for a router-like device to have a single port not connected to the switch (and not part of the bridge). many Mikrotik devices have this kind of setup, as seen in their respective block diagrams.
The rationale behind such a choice is that likely that port will be set (self-standing) as WAN and the other ports (those connected to the switch chip) will be assembled in a bridge as LAN, since the routing will anyway go through the CPU it makes sense that the WAN port is the one directly connected to it. On the hAP Ax S also the SFP 2.5 Gb cage is connected directly to the CPU.
No, this is not normal, and shouldn't happen, but the hAP Ax S is a newish device and there are still quite a few fixes to be made to it, both with cabled and radio interfaces.
The hex refresh and the hex S suffered of very similar problems initially, see:
In any case, as it was suggested initially for the hex refresh/new hex S, the slower port can be used as a management port, or as a port connected to a printer or camera, etc., the issue is/will be if the good Mikrotik guys do not fix it, for the 2.5 Gb cage, a lot of people will (correctly) be upset if the same slower connections happens on it.