It’s a basic legal concept that you can’t just seize pay or any asset, but especially one worked for. So, you may be right that the employer must withhold — again no idea. That said, unless you’ve specifically agreed to seizure in the past, it would be very surprising if the company did not owe you the value of those RSUs, and perhaps the ongoing value of the stock depending on if they’d failed to deliver timely on request.

Who owes the IRS? The Company, on behalf of the person.

Who owes the company for paying? The person.

Each of these are separate obligations. The company is trying to tie them together for convenience, and presumably to wash out some RSU liabilities at the same time.