How do you know that your router doesn't have a 0day that allows them to escape the VLAN?

I dunno. Locking down some things may make sense. But, for the most part, assuming that physical security for your wired home network is sufficient doesn't seem like an unreasonable assumption combined with standard practices for your systems.

Still, network security is extremely hard when the actor has physical access to your networking hardware. I currently live in a dorm situation and put each roommate on their own separate vlan on their own separate wireless gateway behind an f5 firewall running snort and I'd still be at risk if one of my roommates decided to put something between my gateway and the router.

Roommates have physical access to the network. Principles of security tell us you can't defend against that. Need to change the network.

Everything is using port 443 now a days. Yes also malware. You would need a host whitelist.

Not much good against insider / roommate threat

I like some cryptographical guarantees, so my trusted devices get to be on a overlay WireGuard based VPN, and the access from actual ethernet/LAN gets blocked. VPN still uses IP/port blocking, but thanks to WireGuard, you can be sure that source IP really matches the device you think it does.