I came to this post late, and actually by chance but I can give you some insights.
In simple terms, is all about the use-case:
TrustSec is a concept to abstract the network layer by means of using tags, which you can use to create policy. Instead of using plain IP constructs, you can leverage now meaningful attributes for your segmentation policies (e.g finance users can talk to finance app but not to hr app). The main use-case for trustsec is campus/iot/ot segmentation.
Secure Workload on the other hand, focuses on DC and multi-cloud. It expands on the same concept of abstraction, but tailored for DC (e.g ability to have up to 32 labels, plus additional integrations with external systems).
The blurry line is always the possibilities of each product. For instance, you could ask - Can I extend trustsec into the DC? The answer is yes - but you need to consider a lot of factors (e.g switches support, integrations, switches limitations, etc), whereas CSW main focus to address the challenge is by using agents that are installed on the workloads.
