The correct mental security model here is “if you used an account on a company issued laptop/phone/any hardware” == “the company technically already has or can

The correct mental security model here is “if you used an account on a company issued laptop/phone/any hardware” == “the company technically already has or can get access to the data”. There are so many ways for a company to do that. Granted, some of these ways might be legal or not depending on jurisdiction, but then lots of company will thread or cross the legal fine line if they are happy with the risk/benefit trade off.