Tag only one ethernet port with VLAN

The RB5009 is a router, and that is it main purpose, but it has a dedicated switch chip built in, and all ports are connected to the switch, and the only way to get to the router is through the switch. See the block diagram for the RB5009.

So when you use the bridge, the Layer 2 switching fuctionality is offloaded to the Marvell 88E6393X chip, which is a quite capable L2 switch, which will offload all vlan operations when the vlan-filtering=yes mode is active.

So in your case, the 10Gb/s link between the CPU and the switch chip acts like a hybrid link between the interfaces that the router uses to the vlans that the switch uses.

For more info about the "different personalities of the bridge", see RouterOS bridge mysteries explained and Vlan-aware bridge mysteries

This thread may also be of interest, because it is RB5009 related Tutorial: Home VLAN configuration (RB5009, cAP ACs, multiple SSIDs)