It works as expected.
The delayed expansion will expand variables at execution time, not parse time, so it interpret your line ENDLOCAL & SET S1=!S2! as
endlocal
But at the part of SET S1=!S2! the delayed expansion is off so it can't be expanded anymore.
In your case you could use
ENDLOCAL & SET S1=%S2%
As the exclamation mark is S2 is "safe", as the delayed exp. is off at the moment of execution.
But an always secure returning is a bit more complicated.
We discussed it at Dostips: Return ANY string across ENDLOCAL boundry