> assume that HR can view EVERYTHING on your phone, because they can
Patently false, for many values of ‘everything’ and ‘phone’.
An MDM has zero visibility into an iPhone’s browsing history, iMessage content, or the content of any app not installed directly by the MDM. So things like Signal, WhatsApp, and even the default mail app are off limits.