alt Hacker NewsMany devices are indeed locked down. But given that it's an OS company and hardware vendor, many employees have access to hardware with e.g. SoC fusing that allows them to install custom-signed firmware. It's very difficult to make an OS lock out the people whose job it is to build the platform that OS depends on.
I once worked at a cybersecurity firm and they had a particularly botched rollout of MDM to Macs (which would regularly put the machine into an undesirable mode of 100% CPU usage plus max out upload bandwidth repeatedly trying and failing to backup the machine to some online backup service). I had work to do, so I simply disabled the MDM profile for the machine, installed an OS to my liking, and restored the apps I wanted to use, and went about things.
A year or so later the company hit hard times and we had a large layoff that affected me, and at the end of the video call, the directory of my department mentioned that they needed to wipe my laptops but it "wasn't showing up in MDM". I said I'd be glad to jump on a call with IT to fix that, but then he mentioned the IT staff were laid off too.
I then suggested I did get hired for my cybersecurity expertise, that I do take my obligations seriously, and he could just ask me to do whatever they were planning to do from the MDM console, and it would get done. He insisted that wouldn't be necessary since in his worldview the MDM was unbreakable and he just needed to reconnect to Wi-Fi or something.
Very amusing worldview. In the real world, where I live, I would assume a highly competent employee could exfiltrate trade secrets without me being able to catch them via standard / automated means. This particular Apple former employee got caught because he bragged about it, not because of technical means to catch him. As I've pointed out to a number of people, the very best DLP solution can be completely obviated by someone aiming a camera at their company-issue workstation's monitor.