Google Security has a list of supported devices & OS versions that can run their rootkit. Google corporate accounts cannot sign in on other devices. When a device gets too old and rolls off the supported list, they automatically log it out and wipe any company data on it. I believe most large companies operate like this.

Google is actually more flexible than most companies: Any employee can get a company phone and employees are allowed to use their personal phones if they want (and don't mind the rootkit and spying). Surprisingly, a lot of people opt for the rootkit & spying to avoid carrying two phones. This saves the company some money on phones & mobile service contracts. And it makes those employees happy.