This is called a "risk". Companies do different things in response to different risks. To the "company will lose $100MM if one of 150 different people lose their phone" risk, many companies have adopted the "nuke from orbit" control. To the "phones may be infected by data-stealing viruses" risk, most companies have adopted the "qualified stake holder for affected data has signed a document attesting to the company's acceptance of that risk".

If companies had the black-and-white perspective on risk you have here, nobody would ever be able to deploy a line of code.

I don't have a black-and-white perspective on risk, but either the data is worth protecting at a remote-wipe kind of level or it's not.

In most cases, the ability to wipe a typical employee's personal phone in response to anything would be a ludicrous over-reaction.

On the other hand, if you have someone who really does need to access sensitive data on their phone, and leaking that data is a $100,000,000 kind of risk, and there is $100,000s of layered security that normally protects that data, then maybe company IT should be authorised to spend $100s on a properly secured device that they can remote wipe if necessary, in preference to giving an obvious attack vector straight past that security.

As you say, it's about the risk. I don't see any circumstances under which risking using an employee's personal phone to access genuinely sensitive data off-network is justified. Either the damage if it leaks is bad, in which case the barrier for providing a company phone is pretty low, or the damage is negligible, in which case requiring a remote wipe facility that can destroy the employee's own property is silly.