Well good part there is that you can build everything for internal use and then add external access and security later. While VLAN segmentation and overall secure / zero-trust architecture is of course great it's very overkill for a selfhosted environment if there isn't an additional purpose like learning for work or you find it fun. The important thing really is the shell protection, that nothing gets in. All the other stuff is to limit potential damage if someone gets in (and in the corporate world it's not "if" it's "when", because with hundreds of users you always have people being sloppy with their passwords, MFA, devices etc.). That's where secure architecture is important, not in the homelab.