Its more about having physical separation between wan and any of your networking. Removes a potential avenue of misconfiguration, and means you dont have to debug switch config, proxmox bridges/firewalls etc if your internet goes out.
Having a physical port for lan means it can adopt the default anti-lockout rules of opnsense (pfsense has similar). So mistakes on the firewall doesnt mean bricking your network.
And passing them through via pcie passthrough means you can never accidentally join a VM to the wrong bridge.