In my case with 6.43.2 dynamic rules from user profile (incoming and outcoming filter) router is placing the rules on the bottom, after the drop rule, so just by sight i think those dynamic rules were never going to hit because the preceding drop is global.
Anyways in my case im testing the usage of "Address List" instead, so i can place static rules matching the address list before the drop rule (even if addresslist initially doesnt exist because there is no one logged in)
And it seems to work quite nice, hotspot adds and removes the client ip to the address list as soon as the user is active in hotspot or has gone
---------
default action of default firewall chains (forward, input, output) is to accept the packet.
dynamic rules should be inserted into the top position (0) of the list, therefore, last rule will always be last one, so adding /ip firewall filter chain=<input|forward|output> action drop will change the behaviour.
if you jump to custom chain, then default is return to parent chain
if by chance, it is not so (dynamic rule is not added in the top position where they should) you can, for example in hotspot, point to what chain add these rules and then just jump to your custom rules from one of default chains as result, you wount have any dynamic firewall rules at all.