In general a compromised device on the LAN is a pretty serious risk to the rest of the devices on the network. An attacker can launch probes from the compromised machine to look for weaknesses in other machines - for example, do you have remote desktop enabled anywhere? File & Printer sharing? A machine that is not fully patched and up to date, which could allow an attacker to remotely infect it with malware? A device with a web-based control panel (printer, network camera, smart thermostat, router, etc.) that still has the default login and password (or none at all)? This is by no means an exhaustive list of potential weaknesses, but any of these things could allow an attacker to spread to other machines and/or cause more serious damage.
You could go around making sure every device is properly hardened, but even if there are no weaknesses in other devices on the LAN, an attacker could still, say, launch an ARP spoofing attack to redirect all network traffic to the compromised machine, allowing him to monitor all of your Internet and browsing traffic.