>Two hosts on the same subnet can reach each other without leaving the LAN.

Barring "very buggy software," when is this false?

Port- or Client-isolation on Ethernet switches and Wi-Fi access points respectively. Often seen in corporate environments and (properly configured) guest networks.

There are recent "client isolation" features that prevent P2P communication. Some hosting providers also block customers on the same LAN from attacking each other.

Switches and firewalls can do all kinds of things. Probably the most common case is that public/guest wifi networks often have client isolation set up so that different devices on the network can't contact each other. Same subnet, but only access to the gateway and the internet in practice.

(Also can happen if ARP is not working correctly, which can be a right PITA to debug).

LAN spread across sites with a WAN in the middle of it. But that's why I said in my comment that a LAN isn't actually a real thing.

I feel like the better of this is maybe "will" instead of "can"

Yeah… I feel like “falsehoods X believe about Y” need to omit anything a reasonable X would consider to be a bug.

Edit: fair point. Maybe not.

Most consumer wifi routers I’ve used have a setting to prevent peer-to-peer traffic. Whether this still counts as being on the same subnet is kind of a philosophical question.

Some tunnel that extends the subnet somewhere else. Guess it depends on how you define lan.

VPNs