That's precisely what I do - all of my trusted devices are behind a second router[0], with anything untrusted (family devices, devices that only need Internet a

That's precisely what I do - all of my trusted devices are behind a second router[0], with anything untrusted (family devices, devices that only need Internet access and not e.g. access to my NAS) being effectively treated as if they weren't on my local network. Far from bulletproof though - it limits risk, but does nothing to prevent those trusted devices from becoming infecting and having essentially free-reign (which when you use Windows as your main OS is far from a theoretical concern). [0] Introduces a double-NAT, which isn't ideal, but hasn't caused me any issues in practice.