I wouldn't be surprised if a dedicated enough IT at a company is not monitoring your enrolled devices microphones. Just listening in the background for shit-talking the company.
no outside device comes in - no inside device goes out.
So I obviously opted to not enroll my phone, but that came to bite me in the ass one day when I needed to get a train ticket from my company email (it was a business trip) and the policy prevented non-enrolled devices from attaching or downloading attachments...
Felt like a fool grabbing my laptop to let the train attendant scan the QR code.