Would it be reasonable to have this downstream of the router provided by (say) Starlink to securely separate local network traffic from IoT stuff? My paranoia here is in the developing stages.
Discussion
Yes. If you don't need direct network access to your IoT things this is a great option (e.g. if they are all controlled by some server on the internet). Then they can be completely isolated from your local network. That way when they get compromised, the damage is contained.
I do not like that type of IoT device myself. I prefer something where I can be confident it's not going to be connecting to random servers out on the internet. So for the things I run, I want to be able to access them from the local network.
So which network setup is preferable will depend on your situation.