When you bring bridging / switching into the config, all ports switched/bridged will share 1 x 1Gbps path to CPU, so i.o.w:
For routing, if you have 1 WAN port, not part of bridge/switch group, it will have access to CPU at 1Gbps, and the other LAN ports that are in a switched/bridged group, will share a separate 1Gbps path to the CPU.
For switching, i.e. from LAN device to LAN device in a single Bridge, you will get wirespeed as the HEX does have a switch chip, although not a very complex switch chip. The same is not true for Vlan's as the switch chip is not Vlan aware
For a small home/office environment, I personally think the HEX is strong enough to handle VLANs using the software bridge config. If it does become a problem, then add a RB260 to do the Vlan switching on hardware level and the HEX for only routing.
Just remember, with a Vlan HW Offload capable device, that you will only get the benefit of Vlan Hardware switching for devices talking to each other in the same Vlan, if it crosses Vlan's, then it uses routing which must go via CPU anyway.
Hopes it make sense
MTCNA, MTCTCE, MTCRE & MTCINE