Isolation is key if you use any device like this. Separate VLAN for them means stuff like this won't even work and even if they get hacked, they'll have no special access into your network.