What's the difference between 2 and 3?

Wifi 1 is only allowed for corporate issued laptops. We don't even know what the password is.

Wifi 2 for employee personal devices has the password on an internal website and it changes once a month

Wifi 3 changes passwords every 24 hours. It is only for vendors who need internet access to do a demo of their product. When we meet the vendor in a conference room we have to get the password off another web site and then they also get a wifi login screen where they have to list their company name and reason for visit etc.

3 typically requires no password, in the setups like this I've seen. So, bring the VPN.

I have no proof, but given the actions of one employer I believe 2 was for indirectly monitoring what people were doing on their personal devices.

Or 2 could be a "carrot" to prevent people from connecting their personal devices to 1.

If you implement client machine certs, then only corporate imaged machines can connect to 1 in the first place - wired or wireless. 2 and 3 are a bit same-y from my perspective, but the selling point might be “you get a bigger share of the office pipe than the totally open guest network, and fewer restrictions” for 2.

Wifi is always an external network segment. Maybe run different SSIDs to make the use cases clearer or do some kind of QoS; however there isn't really enough spectrum (at least pre 6e) to worry about that in most places.

May as well just use one outside the network AP for everyone, just an easy password everyone knows to prevent parking lot users.

Entry to the corporate network? That'd be the VPN (or wireguard, etc) just as if they were off site.