> Does your setup (easily) allow for things like untrusted IoT powerpoints/lights on the untrusted network to be controlled by their regular apps running on a phone hooked to the trusted network?

Sure, if the control uses direct IP connections it's just a matter of adding some routes - if using broadcast UDP, not so much.