Should use one VLAN per device. I think manufacturers will start using their own mesh networks. If your neighbors have a Vizio TV, your vizio TV will use their connection, same for Samsung, etc. If you have an open guest network, these devices will use it automatically.

The Brother printer I have attempts to hit some static IP in Japan for firmware updates, unencrypted http. So while on some OSes, you can use it without installing a drive, on MacOS, your desktop will automatically download the vendor's software indirectly from Apple. That is why installing printers is a separate permission as it updates system level components.

The only immediate solution I see to this is to have a protocol level firewall say running on an RPi that firewalls the printer off and intermediates all communication between the devices on the local network and the printer.

I need affordable latest WLAN AP with VLAN. Most consumer WLAN APs don't support so we need to buy enterprise or some enthusiast gear.

It seems that on some Xiaomi models, VLAN can't be configured but its firmware is based on OpenWRT, so it can be enabled by hidden API. So maybe SoC itself supports it but manufacturer disable/don't enable it.