SOC2 and other compliance frameworks will take charge of making those flags compulsory, with the threat of being uninsured and willfully personally responsible in case of breach.

At least computers of all other normal workers would be locked down; Those of developers could have development tools but certainly shouldn't be able to connect to production servers or have customer invoicing data in them. Maybe buy two computers for developers with legal tasks? Win-win for Apple.