These kinds of concerns are why I put all my "untrusted" devices on a separate VLANs, so I can reliably shut them out of the internet. Simple VLAN-enabled switches don't cost that much any more. Such a switch allows you to treat any port of the switch as a distinct network interface on your main router, where you can just disable forwarding for selected interfaces entirely. It also prevents your untrusted devices from seeing each other, i.e. your printer wont't be physically able to send ethernet frames to your VoIP phone, even if connected to the same switch. Here is some introduction to the concept: