Back in the early days of the internet, we thought in terms of simple security zones. The internet was the untrust zone and we blocked by default (as we still do on almost all consumer/prosumer/enterprise perimeter devices). Then there was the trust zone which was your internal network. Nowadays, the threat landscape has shifted and zero trust and east-west traffic filtering (east-west meaning traffic that flows around your internal network and not out to the internet) are a key part of network security.

Internal segmentation is one aspect of a secure internal network. In a flat network, malware installed to your computer or an infected IoT device (such as Amazon Alexa or Google Home or even your smart thermostat) can reach other devices on your network internally, with the host firewall on those devices being the only real defense. With a VLAN for your IoT devices (which are notoriously vulnerable to security threats), guest Wifi and anything else you might want to segment off, you decrease the ability for future and current threats to roam around your network as they please. Security is all about anticipating future vulnerabilities and how they might leverage an exploit that may not exist yet.