What good is VLAN if an attacker breaks into your router? (non-rhetorical question) He could forge any packets and networks after that. I also have doubts in my separate wire setup (data LAN + management LAN) because any device with both cables attached can potentially be made into a bridge.