Client isolation is helpful in the real world, but it's yet another band aid for the deeper more fundamental problem.

If a device is insecure when placed directly onto the Internet with no firewall, it is insecure. Full stop. Everything else is a hack around that fact. Sometimes you have to do that since you can't fix broken stuff, but it's still broken.