Why can public Wi-Fi reach computers on the internal network?

Two Wi-Fi names don't automatically mean two separate networks. Both can be mapped to the same VLAN and subnet, so a guest device may be on the same local network as the internal machines. The word public in the network name doesn't enforce anything.

A common setup is to put guest Wi-Fi on its own VLAN and subnet, then configure the firewall to deny guest access to internal networks while allowing the services guests need for internet access. Make sure the access points, switches and gateway all carry and handle that VLAN correctly.

Check what the isolation setting actually does before relying on it. Some settings only stop wireless clients from talking to each other, not guests from reaching wired servers or other internal networks. The exact behavior depends on the equipment and configuration.

Ping is a useful initial check, but it only tells you that those hosts responded to ICMP. A blocked ping doesn't prove the guest network is isolated, and a successful ping doesn't by itself show what services are accessible.

With authorization, test the actual access policy from a guest device after changes. Check that needed internet services work and that internal networks are unreachable, including over IPv6 if it's enabled.

As for why it happens, there are a few possibilities. Someone may have added a second Wi-Fi name without configuring the network behind it, run into VLAN problems, or lacked equipment that supports the intended setup. You'd need to inspect the configuration and ask the people responsible before settling on a cause.