Yeah, this is an important point tbh. Vlans alone don’t add any security if your firewall doesn’t do something to prevent it, as your router will happily forward packets to the next vlan. It should be on a DMZ vlan, meaning traffic is allowed in at the firewall but not to any other internal vlans.
Because no editor can or should try to do everything for everyone. Plugins mean an editor can do a few things well and let others bring specific features they want later.