Should 100% demand a work supplied device for work. Or at worst buy a cheap second Android to use as a work device. There is no circumstance where using your main personal device for work is a good idea.
Thanks for saying this. This was exactly my take. Saying goodbye to VPNs just completely ignores the risk of RCE vulnerabilities on your services. You can have a VPN that still brings you into a zero trust network.