I think the loophole and why it's legal is this: > My computer says It's not your computer. It's the company's computer and they installed the root certificat

I think the loophole and why it's legal is this: > My computer says It's not your computer. It's the company's computer and they installed the root certificate on it. For any non-provisioned machine you'd get a certificate error because the corporate-issued certificates are signed by the corporate CA that isn't browser-approved by default.