VLANs are Virtual LANs. As such they restrict which hosts can talk to each other. They can be an important building block of a secure network where certain resources, such as a database server, management interfaces, etc., should only be accessible to a much more limited set of people/machines/services.
For example if you had a webserver that connected to a backend database on another server you might have:
184.108.40.206 VLAN1 220.127.116.11 18.104.22.168 VLAN2 22.214.171.124
Internet <---> Router <------------> Webserver <--------------> DB Server
Thus your database server cannot connect to the internet (no route and because of the VLAN, no physical connection) and conversely for an attacker to reach the database server, they would have to "pivot" through your webserver first.
In many instances, you can achieve similar security objectives by making use of strict firewall rules or
tcpwrapper. For example, if the DB server should only be receiving connections from the webserver, create a rule that does that. The same should be done for your management protocols, like SSH.
In the end, yes, VLANs can be used as one part of a layered security model. You should also employ firewalls, authentication, updates, and many more controls as part of a defense-in-depth strategy.
There is a good question on StackExchange's security site regarding VLANs. Why do people tell me not to use VLANs for security?