Where I work, they told us upfront "you can have your work email on your personal phone, but if we need to do an investigation for any reason, we're taking your personal phone". And they happily handed out work phones.

Of course, I've worked in security in other companies where employees had their work email and data on their personal devices, and in the event of a security incident we were not allowed to touch their personal devices even though there was work data on it. So it goes both ways.