There is reasonable security. From your link: > an attacker that obtains such a serial number ... will be able to enroll a device of their own as if it were ow

There is reasonable security. From your link: > an attacker that obtains such a serial number ... will be able to enroll a device of their own as if it were owned by the organization, as long as it's not currently enrolled in the MDM server. So, the rule is at-most-once enrollment. And further down: > some organizations elect not to require user authentication as part of MDM enrollment. IOW, if you are not enabling authentication, you have only yourself to blame.