I think the easiest -- but not the best, of course -- ro separate these for the average home user/consumer would be to just "daisy chain" two standard consumer

I think the easiest -- but not the best, of course -- ro separate these for the average home user/consumer would be to just "daisy chain" two standard consumer routers. The first plugs into your "Internet modem/router". Connect all of your "untrusted" devices to it. Your second router also connects to the first, just like the other devices do. Your "trusted" devices will connect to this second router. Your "trusted" devices (PCs, laptops, tablets, etc.) will be subject to double NAT and, of course, NAT is not a security feature but this second router will provide a bit of separation between your trusted and untrusted devices by way of NAT and stateful firewalling, just as it would protect your internal network if it were connected directly to your upstream ISP's network. Again, this isn't ideal but it would work for the average home user and it eliminates the need to deal with/learn about VLANs or buy special hardware that supports them.