How does security-by-isolation score against the Basic Cyber Security Model, and where does it lead?

Badly on interaction: it blocks not only bad interaction but also the desired and permitted kind. Well on the system boundary: the isolation barrier is built exactly there. Today it is realistic only in special cases, and the natural next step is a perimeter model with a very restrictive perimeter.

The Basic Cyber Security Model asks for only good actors doing good actions in a desired environment. Isolation achieves safety by preventing all actions, good ones included, so the system can hardly do its job.

Its strength is the clear definition of the system boundary, since that is where the barrier sits. Under today's requirements the model is no longer realistic, though there may be individual special cases where it makes sense. The obvious move is to the perimeter security model with a particularly restrictive perimeter definition: keep the boundary, but let controlled, desired interaction through.