I'd dare bet that the WiFi-radio and 1000BASE-T -ports are indeed not switched, but connected to the CPU, which as stated above looks very much like a router :)

There's sadly no block diagram released for these, which would document the internal topology. I also do not have this exact device anywhere to look this up from.