Apple's platform, their rules.
Apple is likely shooting themselves in the foot here. These companies' IT departments will no longer be able to support iOS devices for accessing intranet resources, which means no engineers will be using iOS devices as daily drivers, which means their iOS apps will fall further behind their Android apps in quality.
The argument is somewhat moot, anyway. Apple has simply decided that privacy is a tenet of their value proposition, that value is reflected in their contacts granting in-house certificates, and these companies broke the terms of these contracts.
Yeah, that's just marketing. If they really cared, they wouldn't accept a 9 billion dollar payout per year to make Google the default search engine for IOS.