Separating out main, guest, work, internet-of-shit, security & VPN subnets

There is no such thing as an 'internal' network.

It seems like no government wants to kick the hornet's nest & solve this issue, nor the issue of pavement parking. At least this government is finally working on the problem of doctored number plates that are invisible to enforcement cameras. Land a few drivers with a 15 year sentence for perverting the cause of justice & things should right themselves.

Why isn't this flagged during the MOT?

Of course it impedes observability. With IPv6, I can see the IP addresses of the containers that connect to a service. With IPv4, I get (at best) the IP address of the container host, thanks to NAT.

Are you also afraid of port forwarding? Have you considered that your ISP could choose to send your router packets destined for RFC1918 addresses?