These days I treat my home network the same as a public network. Too many "smart" devices to be worth trusting, so the devices I care about are locked down the same as they would be if I connected them directly to the internet - and sometimes I do. Frankly I have more trust that I can keep my phone or laptop up to date than any consumer-grade router (do you know which version of linux it's running? How often do you even get updates?)
This is an order of magnitude more complex than I trust a home router to do, though...
To be clear, I agree that putting IoT devices on a separate VLAN is a good idea but I do that because they're black boxes, not because they're malicious.
- Those controllable (only) through the manufacturer's server and requiring an Internet connection: put them on the guest network that only has a (NATed) route to the Internet and nothing else (ideally, of course, don't buy them);
- Those controllable over LAN and not requiring an Internet connection: put them on a jail network that has a route to the main network and is firewalled away from the Internet (and perhaps from initiating connections to the main network as well).