The Problem

By default, mobs protected from tnt and ghast fireballs, but not from creeper.

A Solution

Make creepers unable to damage non-hostile mobs. Maybe, if targeted at a non-member.
Maybe, remove this https://github.com/EngineHub/WorldGuard/blob/master/worldguard-bukkit/src/main/java/com/sk89q/worldguard/bukkit/listener/EventAbstractionListener.java#L879 and add check with flag in WorldGuardEntityListener

Alternatives

No response

Anything Else?

No response

Can confirm. I think the more general issue here is that the EventAbstractionListener shouldn't add non-protection-related flags as relevant flags at all, because those are usually allowed by default. Those flags should actually always be checked in a second pass by another listener (e.g. WorldGuardEntityListener, RegionFlagsListener, etc.), like many other non-protection-related flags are currently handled. Basically the same issue exists for other flags too, which causes for example #1675.

As said, one solution would be to remove all occurrences of non-protection-related flags from EventAbstractionListener and add additional checks elsewhere. However, this would make the affected flags less "powerful" (i.e. you can then only use them to deny something, but not to allow something or overwrite region protection).

Another solution would be to make those flags protection-related (i.e. removing the default value). I'm not sure if this solution has any downsides that I'm currently not thinking about.

However, note that you can also achieve your expected behavior by setting those flags to deny for the -g nonmembers. So I'm not sure if this is really an issue in the first place.

i can confirm, creeper can also destroy armor stands in regions by players (player actions as root cause)

Version: WorldGuard v7.0.8-beta-01+cbb2ba7

-g nonmembers for creeper-explosion is not a viable solution as it has side effects (players get no more damage) and requires some effort in many regions

so its a bug and not a feature-request