Why were numerous Daedra able to enter Nirn even after the Dragonfires were re-lit?

According to Oblivion lore, the dragonfires protect Nirn from invasion from the Planes of Oblivion.

From The Amulet of Kings:

The high and haughty Ayleids relied on their patrons, the treacherous Daedra Lords, to provide armies of Daedra and dead spirits; with these fearless magical armies, the Ayleids preyed without mercy upon the young races of men, slaughtering or enslaving them at their whim. ... ... Akatosh, looking with pity upon the plight of men, drew precious blood from his own heart, and blessed St. Alessia with this blood of Dragons, and made a Covenant: so long as Alessia's generations were true to the dragon blood, Akatosh would endeavor to seal tight the Gates of Oblivion and deny the armies of Daedra and undead to their enemies, the Daedra-loving Ayleids.

Most notably, Mehrunes Dagon invaded using portals to his realm during the Oblivion Crisis, which were closed after Martin re-lit the dragonfires. However, there seems to be several exceptions to this:

1. Sheogorath's portal in the Niben Bay remains open


2. Daedric princes Sanguine and Sheogorath were able to enter Nirn at will in Skyrim

Even if we say that (1) and (2) don't count because they weren't trying to invade Nirn, Umaril the Unfeathered returned with Meridia's Aurorans during the Knights of the Nine questline, with grand ambitions of seeking revenge not just against Tamriel, but against all the Divines. This appears especially strange given that (a) Umaril is immortal and half-Daedra, (b) he's also and Ayleid and (c) the Covenant with Akatosh was forged to protect Alessia's kingdom from Ayleid Armies of Daedra; one of their major enemies was Umaril himself! One would think that the covenant should apply in 3E if it did when Alessia was around.

What exactly does lighting the Dragonfires do?