Fully agree. I always create employer-specific IDs — Apple, GSuite, Github, and so on. It typically starts from a company email address and fans out.

It confounds me how many of my colleagues don't do this. But when I explain my reasoning, nobody has complained.

I understand that Apple requires its own employees to use personal IDs, which is really messed up. That organizational design flaw probably contributes to situations like the one we're discussing, since it might seem abnormal to an Apple person that someone would be associated with multiple IDs.

Apple does not require you to use your personal ID on your company laptop, but they do require you to use a [email protected] email for an iCloud account (only really needed for Find My Mac, but you’re allowed to use other iCloud features if desired). Many people for expediency just use their personal account, but after various high profile issues in the news many have realized it’s worth the hassle of creating a second account (e.g. [email protected]).

I wonder what Apple’s explanation/justification for this is?

My guess would be that iCloud UX is designed around a lifestyle with a single account per person, and they want their staff's UX patterns to mirror their customers' as closely as possible.

When you wake up in bed you don't grab two phones, you grab one.

One of the account recovery methods is to request that Apple email you an "unlock my iCloud account" web link.

If they were to send that email to your locked iCloud account, you wouldn't be able to receive it.

Operating by fiat? Because they can.