This topi c did come up in the past few times and you can probably search the community for past discussions.
There are people in favor of separating physical connectivity by security zones and those who advocate trunking on the bonds.
My personal opinion is that in a cloud based environments we are relying on the trunk interfaces every time we spin-up a vSEC instance. Same goes for VSX (mostly, not always) for the external connectivity via shared switch.
If you do not have the 10G capacity, bonding 1G and trunking it is not a bad thing, IMHO. You still can have separate trunks for zones, but you'll gain the flexibility of dynamically adding more networks to your Check Point gateways programmatically, as opposed to requiring a cable runs each time for the physical interface based deployments.
There was, in the past, for a brief time a VLAN hoping exploit, but switch manufacturers have clamped down on it pretty fast and I did not hear about similar techniques succeeding recently.