Searcher1,
To answer your question about whether there's any sort of 'mechanical switch' available: Well, there may well be but a mechanical switch should be avoided if at all possible in a highspeed connection such as this. You can, of course, readily disable the Ethernet connection at any time by simply right-clicking on the double-screen icon in the systray and clicking Disable. But this is for the situation where the PC is already up and running, and re-enabling the connection is a bit of a fag, as you have to go right into Device Manager to do it.
You also ask how I know that the port is live at the moment of power-up, Well, not only is there a little status indicator light incorporated into the port itself but also the Ethernet channel status on my router tells me the condition of that connection. I concede that we're in an area where we just don't know for certain whether, during power-up, the Ethernet connection is truly being enabled at all, but the router and the port use an "I'm operable" signal (part of the Ethernet interface) to pass to each other. The practical validity of that signal is dependent on the DC supply voltages of the respective devices. Thus, both have to be saying "I'm operable" for the Ethernet channel indicator, either on the Realtek port or the one on the router, to be lit. It's, in effect, an AND function. In fact, what I'm seeing with this PC is that when Windows is closed down (the PC closed down), the channel indicator is off. That's sensible. But during the power-up phase, the indicator on the router (which is showing the overall operability of that connection) lights all the way through the BIOS's action, then goes out as Windows launches, then comes on again well before Windows finishes booting. Given that the very first thing the BIOS does at power-up is to check all the DC voltages and gives a single beep if all is okay with them, I would venture to say that the Realtek port on the PC ought to be in a position, between that point and before Windows completes booting, to properly disable the connection, ie. to say "I'm not fully operable yet because Windows hasn't fully booted". To me, that it doesn't do that is concerning.