The administrator can set all sorts of policies, like if a PIN is required, or a password, length, etc.

It's not a bad thing and can be used to potentially limit some damage. Of course, requiring a fully encrypted device with strong lockout policies that are hardware enforced (TPM) is the best. I've had my phone stolen and it was pretty nice to remote nuke it.

IIRC, Google offers this same feature if you connect it to Device Manager.