It is far more danger than most people guess. When we debated how much someone could do from Local Admin (local account, not domain account) on one domain-joined machine, I said "Would you like to find out?" Nobody did. Turned out they wanted to debate the theory but not put it to the test.
I argued on the other question what are you defending against. Well here's the thing. The next time anybody else connects to the machine in question, the local admin can impersonate that user. If it was a network share access, the impersonation can be only used for a few minutes. But a few seconds of domain admin is plenty to create a service on a network share on the domain controller.
In the old days it was stupid worse. The machine can MITM-attack anybody on the network not specifically defended against arp-spoofing. Until recently, this was the end game, but MS finally got their act together and closed SMB against MITM by fixing the auth package and actually making a backwards-incompatible change so that it stays fixed.
But not permitting the developer's VLAN access to the internet is dumb. Perhaps the best thing to do is let them have admin on their machines or VMs but simply not join them to the domain.
Yet this almost never comes up. The threat of being fired and prosecuted keeps the developers from going all-out like this, and for some reason internet-bourne malware doesn't use this stuff. So again, what are you really defending against? The developers probably can take over anyway. You've got to install version updates on production sooner or later.