>and then a second device if you want to play.

With virtualization this could be done with the same device. The play VM can be properly isolated from the secure one.

How is that supposed to fix anything if I don't trust the hypervisor?

It's funny, GP framed it as "work" vs "play" but for me it's "untrusted software that spies on me that I'm forced to use" vs "software stack that I mostly trust (except the firmware) but BigCorp doesn't approve of".