From the syslog-ng administrators guide (v 2.0, which is old, but what you're using)
When a log statement includes multiple filter statements, syslog-ng sends a message to the destination only if all filters are true for the message. In other words, the filters are connected with the logical AND operator. In the following example, no message arrives to the destination, because the filters are exclusive (the hostname of a client cannot be example1 and example2 at the same time).
So that makes sense, it would be way too complicated and undocumented if it worked any other way. So you're going to have to find some other way of accomplishing what you're trying to do!
It looks like, in general, the way you would want to exclude a host is to use
not host('HOSTNAME') or (host('HOSTNAME') and level(...) ) as your filter.