Your comment about #2 is not true. VLANs can be fully isolated from other subnets on the LAN - sure. But they can also NOT be isolated. I have one fully isolated VLAN, and the rest are not isolated.

With a savvy user, you can also tehnically isolate VLANs form only specific other VLANs. I’ve never needed to do this, but know it’s possible.