I can manually stop/restart the Sophos services exprect web control on Windows clients. Did I miss something or does the Endpoint not protect itself by locking its services ?
Nope, you didn't miss anything: currently Tamper Protection is circumventable by stopping services. However, the endpoint will show up as down or out of compliance in Webadmin if a user does this anyway.