> I then suggested I did get hired for my cybersecurity expertise, that I do take my obligations seriously, and he could just ask me to do whatever they were planning to do from the MDM console, and it would get done. He insisted that wouldn't be necessary since in his worldview the MDM was unbreakable and he just needed to reconnect to Wi-Fi or something.

Which is hilarious. They've fixed (or at least made it more robust), but until at least Ventura, you want to know how to circumvent MDM entirely on Apple Silicon?

Do a fresh install with Internet access. When the machine goes to do the first reboot during the process, null route three hostnames on your router/DNS: deviceenrollment.apple.com, mdmenrollment.apple.com and iprofiles.apple.com.

Complete setup and get logged in.

You can now remove the null routing. Your machine will never phone home again for MDM enrollment. You can upgrade, all the way to Tahoe. No issues.

As of the more recent releases, the installer does do some checks to ensure connectivity to those hosts, that I haven't bothered or needed to try to circumvent... but yeah, the idea of Apple ensuring their MDM to be unbreakable, durable, robust is laughable.