Putting IoT devices on your guest network is a very common home security/privacy thing to do. They very often snoop when they can, and your router shuts that down on the guest network.

I want my router to allow my IOT devices to send out mDNS beacons, and for other devices to connect to them, but otherwise they're restricted and logged.

This is an order of magnitude more complex than I trust a home router to do, though...

Even on my UniFi gear its still a bit of a faff every time a manufacturer does it slightly differently (and still raises my suspicions when controlling google home devices doesn't work / not receiving mDNS broadcasts etc).

Beyond mDNS "snooping", has there been reporting of non-compromised IoT inappropriately listening on networks?

To be clear, I agree that putting IoT devices on a separate VLAN is a good idea but I do that because they're black boxes, not because they're malicious.

Well when you're setting up your Roomba in the roomba app, the amazon alexa app unprompted sends a notification to allow Alexa to control it. Only way could be the Echo is listening and hears the Roomba broadcast packets.

If they're on the guest network, how do you control them? Over Bluetooth?

There are two categories of devices worth considering:

- Those controllable (only) through the manufacturer's server and requiring an Internet connection: put them on the guest network that only has a (NATed) route to the Internet and nothing else (ideally, of course, don't buy them);

- Those controllable over LAN and not requiring an Internet connection: put them on a jail network that has a route to the main network and is firewalled away from the Internet (and perhaps from initiating connections to the main network as well).

Absolutely - Never trust the wire, whatever wire it is.