Isolation limits the blast radius.
Flat networks are easy to run until a compromised laptop can see servers, cameras, printers, management interfaces, and guest devices. Gateway designs separate zones for WAN, LAN, servers, guests, management, and operational systems, then defines which traffic may cross each boundary.