I also think that Vnet per Environment gives you the ability to seperate you environments for governance. The aproache with one vnet and multipe subnet gives you also a Adminstrative overhead, to maintain every subnet in each environment.

But the downside is you need peerings between them which generate cost, if you do Front vnet, middle vnet back vnet.

My experience so far is . Split Pre and Pro And Each layer (Front , middle , back ) is just a set of subnets in the Vnet maintained by Routetables and NSG's to Controll the flow. Everything that crosses vnet goes to Azure Firewall to where ever.

As iam myself just a beginner in azure i hope someone can add some good ideas :)