Part of me thinks that MDM on employee phones has become a something of a checkbox item because customers ask for it but it's not clear to what extent it really protects sensitive customer data (which is what they're concerned about).

It is literally a checkbox item for PCI DSS.

Can you share the requirement from PCI DSS? [it's not]

Like most normal people I have no idea what PCI DSS requires. All I know is what the PCI compliance inquisitor says it says, or really what my risk management guy says the compliance guy says it says. And what’s the difference? If he says he says it says we have to have MDM on BYOD, it’s not like I’m going to write a first-principles rebuttal.

Having the code review app available outside of the corp network / VPN is pretty unusual, at least for shops who aren't just using SaaS services that are available publicly anyway (github, gitlab.com, etc).

You must have missed their "zero trust" initiative.

"""BeyondCorp began as an internal Google initiative to enable every employee to work from untrusted networks without the use of a VPN."""

https://cloud.google.com/beyondcorp

I'm aware of it as a Google thing, but I think it's fair to say that it's pretty unusual to see it anywhere else.