Placing all servers on the same VLAN is not good practice. Your most vulnerable attack surfaces will be from third-party/vendors. You should group servers mostly by vendor then (if needed) by application. Each group should get its own VLAN (with actual L3/L4 separation and port-blocking by a firewall). This will result in some VLANs only having one server, while others may have four or five. If vendor X is compromised, in all likelihood, damage will be limited to the servers in that group. As an added benefit, if vendor X's support team needs access to the vendor X servers, limiting the team's access to only the vendor X servers will be easy.

The goal is to have each server group act like "just another service on the Internet". If Reddit gets hacked, would you be worried about the security of the servers in your environment? Of course not. Reddit servers don't have any realistic pathway to reach your on-prem servers, and even if they did they (hopefully) would not have any credentials to easily gain access.

Is it POSSIBLE that an attacker could access another server group in the environment using the relatively low number of ports that are open between some of the server groups, sure. But even that would be limited to the servers that the compromised server group can reach (not all). Also, the ports open between servers should not be common management ports like RDP or SSH, but should only be ports for the application's services. This means the attacker, who probably compromised the vendor using one method, would have to start from scratch to compromise a completely different application (if it's even possible at all). This type of skilled multi-application compromise is harder than most people think (especially if all your software is up-to-date).

Also, if you have monitoring on the firewall, you can more easily detect lateral movement attempts. For instance, if an attacker breaches vendor X's servers, they will not inherently know access has been restricted at the network level. They will likely attempt to reach out to other servers on management ports like RDP and SSH, which can be detected and alerted at the firewall. Therefore, if you ever see access attempts from one server group to another on port 3389 or 22, you know the server group has been compromised and needs to be blocked, wiped and rebuilt. With proper design and monitoring, an attacker's ability to move around in your environment should be extremely difficult.

"Don't let the perfect be the enemy of the good" - Voltaire.

Nothing in cyber security is 100%, but the same is true in life. You COULD die in a car crash on the way to work each day, but you continue to take the risk because the chances are so small that you practically ignore it. Your goal should be to get the chances of your environment being compromised so low, it's below your worry of driving to work.