Apple said in one of their WWDC keynotes somewhere that because use of personal devices for work was so common, Apple was going to sandbox and limit access to personal data after signing in to a work account - so the most work could do is erase their part of the device and not erase or touch the entire device. The idea being that if you bought the device and it wasn’t provisioned from work, then signing in with a work email should only ever affect your work accounts and apps that access them. But I might have the details wrong, haven’t looked into it in detail yet. The iOS feature is called “Account-Driven User Enrollment”, there’s a WWDC video on it from last year.