Since you're not NAT-ing, then you shouldn't have chain=src-nat rules.

chain=forward, action=accept means that ALL packets can forward between the subnets. If you'll permit all, then you don't need a default deny rule. And if you don't have a default-deny rule, then it's permitted anyway. So this rule would be superfluous.

chain=input, action=accept means that every node on any of your subnets can connect to a service running on the Mikrotik itself. So like winbox, dns, etc. Typically you'd have a default-deny rule for the input chain and then allow service ports as required (like winbox, or whatever your preferred management interface is). But add the accept rule before your deny rule otherwise you can lock yourself out of the device...

With default config your physical interfaces may be in the same bridge. Good idea to delete the bridge.
Also with default config there may be masquerading on the ether1 interface. You'd have to get rid of that if you're using ether1.

The devices on each subnet would have to have their default gateway set to the IP you've given each vlan interface.

When a packet comes into the router whether on an ether interface or vlan interface, it will be routed.

Nothing you have said makes any sense to me.
If you have two subnets that need full view of each other, then simply put them on the same subnet.
You can try and put the two groups on different pools within the same subnet for example so they have some degree of separation.
The only reason to have different subnets is if there are restrictions on the traffic between them, if not, there is no reason I can see.
So please confirm the reason??

You really need to scrap all the silly rules made to try and twist this setup like a pretzel.
Start with the defaults, and come clean and let us no what the use cases are for devices and users on the two subnets (without using any words containing the config).

the use cases

/ip address
add address=192.168.1.1/24 interface=vlan1 network=192.168.1.0
add address=192.168.2.1/24 interface=vlan2 network=192.168.2.0
add address=172.16.16.1/24 interface=vlan3 network=172.16.16.0
/ip firewall filter
add action=accept chain=forward
add action=accept chain=input
/ip firewall nat
add action=masquerade chain=srcnat src-address=192.168.1.0/24
add action=masquerade chain=srcnat src-address=192.168.2.0/24

To have your subnets access the internet, you would only need to do a src-nat masquerade rule on the WAN interface only. All other interfaces should not have src-nat or dst-nat. No mangle rules. Since you've already removed the bridge, then when packets come into the router then they should be routed according to the routes list.

Check the IP > routes. A route should've been created for each interface in which you assigned an IP. For example, you should see 172.16.16.0/24 listed with a gateway of vlan3
If it's still not working then I'm wondering if the incoming packets are actually tagged? If they're not tagged you'd see them coming in the ether-interface and not vlan. What do you have on the other end? And which vlans are attached to what physical ports?

What is your WAN interface on that router? Ether1?
These two lines are incorrect:
add action=masquerade chain=srcnat src-address=192.168.1.0/24
add action=masquerade chain=srcnat src-address=192.168.2.0/24
Delete them.

Then add
add action=masquerade chain=srcnat out-interface=ether1

And the default route (the 0.0.0.0/0 one) that will already be there if ether1 uses a DHCP client to get the public IP. If you set a static IP on the WAN then you have to manually add the route.