FWIW, with JAMF, your employer can ship it straight from Apple to your door, and still get their MDM all over it the second it connects to the internet the 1st time.
Where I work we managed to ship thousands of laptops to students homes from the manufacturers during lockdown and but still ensured that they had the correct E-Safety software and configurations on them when they turned them on for the first time.
On iOS however, it can't. iOS won't let itself activate without internet.
How would that work?
We do this for all Macs and iPhones for our employees, we buy them directly through our Apple business portal and it all automatically registers to our JAMF account.
This seems ripe for exploiting for nefarious purposes. With Apple having built it, all it takes is one court order targeting a serial# and it auto-installs full remote control spyware on that mac?