The basic reason as to why autonomous AP's need trunk ports and lightweight AP's don't does indeed have to do with the capwap tunnel that is used between the AP and the controller. You can attach the access point that is enabled for FlexConnect to a trunk or access port on the switch. APs can also be placed in rogue detector mode. In this mode, the rogue detector AP is placed on a trunk port so it can monitor all wired-side connected VLANs, and the AP radios are turned off.