To compromise a device on a vlan it had to get through the firewall. If your firewall couldn’t stop it then it can attack any other device by going through the firewall because again the firewall didn’t stop the device from being compromised in the first place.

You can do that at the router. You don’t need vlans to block Mac addresses.

haven’t really found any personal need for VLAN segregation

I feel like many setup vlans “because it exists”, not for actual need. The security reason generally doesn’t exist for home labs because most need to setup bridging or you can’t access the devices on the secure vlan at all.

Won’t help now but only deal with contractors that have a contractor license. That license number means they paid insurance into a fund so if they take the money and run, you can recover your money from the state insurance fund even if they personally don’t have any money.

It took like 3 years for the process to work through but I got back all my money from a contractor that took a payment and disappeared.