That's kind of bad advice, I mean the entire point of Docker is to not have multiple VMs, and you don't want to expose the Unraid GUI to the internet, but any internet related Dockers are always exposed, because they have to be. How are you going to run a Nextcloud docker with no external access? That's only one example.
To the most direct question that was asked --- from the most extreme standpoint, if any device on your network were able to be compromised, whether it was Nextcloud on a Pi, in a Docker, whatever, the POTENTIAL for complete intrusion is possible. Doesn't matter how many ways you try to separate them. The only way to possibly mitigate complete intrusion is to have each device on it's own separate network, as much as you could.
