I have a Sonos in a pub (although this applies to any public place which shares the wifi).
The router (TP-LINK Archer VR4000) has a guest network and this is locked to not share the local network. It works as expected.
The issue is, when using casting media I can access the speakers directly. This also appears to corrupt the router and after I do this with casting software, I can access the Sonos via the guest network (and as such I am assuming I can see other devices on the network too, although not tested as that is outside the scope of this question)! Sadly, guests are doing this!
Sonos (I think) don't provide any way to restrict access. There is no password on the app or a way (that I know of) to lock the speakers to a single router. As such I am thinking this is quite possibly a more 'common' issue for IoT devices.
Assuming Sonos will not provide this functionality, how do I restrict this as guests are changing the songs.... and there is only so many times I can hear the birdie song!!! :)