This looks like part of their push to passwordless. Decent camera plus TPM means that FaceID style unphishable FIDO2 credentials can become default moving forward.
It means you can't use computers running retail editions of Windows 11 inside secure areas.
These kinds of requirements will absolutely not be mandatory under enterprise / volume licensing.