The administrator can set all sorts of policies, like if a PIN is required, or a password, length, etc.
It's not a bad thing and can be used to potentially limit some damage. Of course, requiring a fully encrypted device with strong lockout policies that are hardware enforced (TPM) is the best. I've had my phone stolen and it was pretty nice to remote nuke it.
IIRC, Google offers this same feature if you connect it to Device Manager.
You'll see a warning when you set up mail for the first time. I think if the server has this policy you are forced to add a pin lock to your device.
If you don't remember seeing anything, then AFAIK your device cannot be wiped.