Hardware switches are coming again. We have lots of Energy Meters from Siemens (PAC3200) with Ethernet. The new model PAC3220 I got a few weeks ago, does have a hardware switch for write access from network, just like the old S7 PLCs had RUN and RUN-P (write access) 20 years ago. We have a VLAN just for the energy meters, each Meter a separate switch/firewall port, just open ports for Modbus-TCP and no client-client connection allowed. Same for PLCs.

https://mall.industry.siemens.com/mall/en/us/Catalog/Product...