Once upon a time that was the case - "Cyber Monday" as a prime case in point. Some limited amount of non-work browsing is generally still fine at most offices I deal with, most notably checking news, weather, sports scores, etc.
However as a person responsible for making sure there are no breaches (particularly reportable ones) at offices, I'm moving more and more to the "No personal use. Period. No debate." position. I can control the kind of filtering, AV checks and attachments that come into the office via the business email as an example, but if people are checking their personal email on company systems I may not be able to catch the "Huh, I don't remember ordering from them, I wonder what this invoice email is all about?" person. Antivirus is all well and good but it's not 100%, and while I can look at the mail filters and see that there were 400 PDFs with variations of "Delivery Notification" or "Invoice 1234567" blocked in the last half hour to a ton of different addresses, Jane Smith in Billing or Accounts Payable may only see one or two - and on a really bad day, opening just one may be all it takes.
Also, these days a huge percentage of people not only have smartphones but use those smartphones as their primary devices for Internet access. 5 years ago that wasn't the case, but now? George with the iPhone 7 Plus can quite easily check his email or do plenty of other things that would have been much less pleasant on an iPhone 4.
Wouldn't Jane Smith from Accounts Payable anyway open a PDF invoice email, regardless of the address?
Of course, if someone is signing into their personal account using work hardware, they're basically saying they trust the company not to do any intrusive monitoring, where "intrusive" is something I'm deliberately leaving a bit vague. The company probably has some idea what sites they visit but employees expect that the company is not stealing their credentials or having someone virtually read over their shoulder without a very good reason. If outside intruders get into work device management servers and such, employees' personal stuff is at risk also, but they're willing to accept this for the sake of convenience.
I have, on my work-owned laptop, both work and personal Chrome profiles. (The analogous Firefox feature is multi-account containers.) I might only bring a work laptop when traveling for work. Most of the time, and certainly if I'm presenting during a meeting, I'm using the work profile. I'll use the other only when I'm alone. I lock my screen when I'm not there; I have sensitive access, so this is expected for reasons other than protecting my personal data.
Conversely, work allows me to access my work email and some other internal sites from my personal phone if I agree to certain device management restrictions. I do this rather than carry two phones. Some people choose otherwise.