When placing the Time Capsule in Bridge mode, you are turning off NAT, and IP operations.
The ability for guests to be able to get to the Internet but not be able to access the home network was a result of access rules that stated the IP range that supports the guest network are not allowed to talk to the other internal network. It is possible to do such a thing using a technology known as private-VLANs, but I don't think the Time Capsule has that sophisticated of code. So, when we put our router into bridge mode, we become one layer 2 ethernet bridged network - that is bridged to the Access Point - within one IP network.
There does not appear to be the code necessary to do layer 2 (ethernet/wireless ethernet) separation and security. It is doable, but apparently not in the Time Capsule.