Subnets are managed at the VM level. A compromised VM can change it's subnet to loop through all the possibilities. By their very nature, surely they cannot be considered secure?
Note: I'm not a networking guru - so I may have missed something blindingly obvious...