My primary purpose for separating services is stability. My file server is just for file services - so if my media server needs a reboot it doesn’t affect anything else, like my media conversion server, etc. Preventing lateral movement is really a secondary benefit. If someone gets in, my ability to prevent lateral movement as a non-enterprise is pretty limited. I still use separate user accounts for different purposes with heavily restrictive permissions.