There is a nearly endless list of ways that an adversary can compromise an organization’s workstation, from USBs in the parking lot to malware laden email attachments. We should design out environments to account for the eventuality that one or more workstations will get compromised by an aggressive adversary.
Enabling port isolation on your wired networks and client isolation on your wireless networks limits opportunities for lateral movement between workstations. Isolation, of course, will not prevent all lateral movement opportunities, but if implemented properly, it can significantly limit the ability for an adversary to hop from workstation to workstation across a local subnet, collecting credentials, and will force the use of potentially more noisy/easier to detect techniques. The name of the game is making the lives of adversaries more difficult, take longer to accomplish objectives, and make more noise in doing so.
I once had a discussion with an unnamed person from an unnamed agency that told me that part of the agency’s penetration testing regiment includes connecting a drop box of the pen tester’s choosing to the agency’s wireless or wired networks (including an LTE modem for out of band access), to simulate a workstation being compromised and needing to rely on other aspects of the infrastructure to protect systems and data from further compromise. Port isolation was part of the strategy for that agency.
The downside implementing isolation is that it requires much more deliberate design of common services, like the placement of printers and scanners. Coincidentally, one of the other upsides to implementing isolation is that it also requires much more deliberate design of common services, like the placement of printers and scanners.