Wow, maybe this is the push I need to finally set up an isolated "IOT" VLAN at my home.
I've ended up with numerous VLANs, one for entertainment devices, one for security system(s), one for guests, one for IoT trash, etc.
If the devices are this level of untrusted, there's a lot of separation necessary.