Agreed but a problem is when employers require installing software on personal devices (like phones) in order to access fully work-managed devices. How does one

Agreed but a problem is when employers require installing software on personal devices (like phones) in order to access fully work-managed devices. How does one know that the 2FA software is not sending out other data? This is my concern because many work places seem to expect employees to use their personal phones in this way.