Exactly, it doesn't!
If you have data that is important enough for leakage control at the edge of your network, then it must not be accessible outside of your controlled systems at all.
An employee's personal phone is never a controlled system for the purposes of this policy.
After all, what if the phone isn't stolen, but infected by a data-stealing virus during the employee's personal use?
If companies had the black-and-white perspective on risk you have here, nobody would ever be able to deploy a line of code.
In most cases, the ability to wipe a typical employee's personal phone in response to anything would be a ludicrous over-reaction.
On the other hand, if you have someone who really does need to access sensitive data on their phone, and leaking that data is a $100,000,000 kind of risk, and there is $100,000s of layered security that normally protects that data, then maybe company IT should be authorised to spend $100s on a properly secured device that they can remote wipe if necessary, in preference to giving an obvious attack vector straight past that security.
As you say, it's about the risk. I don't see any circumstances under which risking using an employee's personal phone to access genuinely sensitive data off-network is justified. Either the damage if it leaks is bad, in which case the barrier for providing a company phone is pretty low, or the damage is negligible, in which case requiring a remote wipe facility that can destroy the employee's own property is silly.