I have a dedicated IOT ssid and vlan (when my Orbi goes, I don't know what I'll replace it with...).

Each wifi node on that ssid is in client isolation mode and I carefully monitor where outbound traffic from that segment is headed.

It's a lot of work, but it makes me feel slightly better about a thermostat, self-hosted security camera setup, and home assistant setup.