I can think of a couple of reasons this may be the case:
While there are many brands of Access Point hardware, they all source the wireless chipsets that power them from a handful of manufacturers (Atmel, Broadcom, Intel, Marvell etc.). I would suggest that it's probably an inherent limitation in these chipsets that higher-layer filtering is not supported.
There is no presumption in the 802.11 standard that the transport layer is TCP/IPv4 (even if the vast majority is).
Most commercial wireless vendors that I am familiar with (specifically Aruba and Trapeze/Juniper) only enforce L3 ACLs and Firewall policy either at a centralised hardware controller, or virtualised instance of this controller within one of their APs - essentially between the ESSID and the VLAN it attaches to, meaning that WLAN clients can only be controlled with the all-or-nothing approach of AP isolation.
On a somewhat related note - AP Isolation mode works well when you have a single Access Point on your network, but consider what happens when you have two or more and a client roams. Their MAC is now learnt on the uplink interface of the original AP, and will now be able to happily communicate with clients.
This is solved somewhat with "Thin" and clustered "Thick" APs, but stand-alone "Fat" APs can't do much about it.