> that could lock their company provided devices for ever when they leave

MDMs like JamF offer override codes to disable activation lock. Hasn’t been an issue in my experience.