Hello,
So... at the end I got a RB5009.
viewtopic.php?t=205266

I have a FTTH line at my home and in 1 hour the 5009 was up and running, but not using the SFP module.
Eth1 is the WAN, connected to the ONT of the ISP
Et2-Eth8 are bridged
I configured the NAT, the firewall, DHCP, DNS, etc. etc. and also the port forwarding since I need to connect to a service running in my home
... let me say... it works great and I also removed the power injector of the APs I have around, being the RB5009 the PoE version.

Now... I need to backup my FTTH with a LTE USB stick. It is the k5160 and it is recognized by the RB and, once configured the APN, it works.

Let me say... having both the fiber and the LTE, the first has a "distance=2" while the the pppoe of the ISP is zero, so... the traffic go through the fiber.
If I disconnect the fiber, then from the RB itself I can reach the internet through the LTE, but not from my LAN because of the NAT masquerade rule that has a out-interface poiting the pppoe. Changing the NAT rule to point to the LTE... everything works.

How can I fix this behaviour to have the NAT rule to manage this swap in the out interface?

You can add a masquerade or srcnat pointing to the LTE interface.
Or you can use a list, like out-interface-list=WAN see:
viewtopic.php?t=205301#p1060988

If the distance is higher the route won't be active so there won't be traffic out of that port.
The issue is only that the setup (as you described it and assuming you have check gateway set) will switch to LTE only if the Mikrotik loses connection to the ISP router (not if the ISP router has no connection to the internet) unless you use either recursive failover detection or Netwatch.

There are many ways to skin a cat in RouterOS (most of which poorly documented or complex for the uninitiated) you may want to have a look at this approach explained by Filo:
viewtopic.php?t=198999
which is clearly explained and easily reproducible.

The "logic" there is inverted, the LTE route has lower distance BUT it is kept disabled and only enabled if the wired gateway cannot reach internet, it is simpler than most alternatives.