Seems like that's true: https://learn.microsoft.com/en-us/sharepoint/redirect-known-...

When you log into a business Microsoft account on Windows or in Office, it asks you if you want to give your business control over the device. She might have answered “yes” to make the prompt go away (and “yes” is a sensible answer on a corporate laptop, but definitely not when using a personal laptop for work/university)

I would assume that the college IT dept is using tools made for businesses, which businesses will usually set up on machines they own (that is, not employee personal hardware), so in that case it's not unreasonable for the business to be able to set up which folders get backed up. Of course, it's never a great idea to store personal things on your work computer, for this reason and others.

But of course that model isn't a great fit for university students, who will usually not have a laptop issued by the university. Not an excuse for this happening, but I can understand how it would.