Flat network compromise spreads everywhere
Firewall Sales Portal CRM App Tier HR Finance DB
Compromise the internet-facing portal and, with nothing stopping lateral movement, the attacker reaches every application - including the finance database.
Segmented network compromise is contained
Firewall allowed allowed Sales Portal App Tier Finance DB CRM HR
The same compromise is boxed into its own segment. It can only follow the paths that were meant to exist - so CRM, HR, and the finance database stay out of reach.