This was more likely an Intune admin getting phished. Intune has a built-in wipe action: https://learn.microsoft.com/en-us/intune/intune-service/remo....

Which in itself wouldn't be too bad, if mobile platforms had proper backup facilities that allowed individuals and enterprises to easily get all their devices to the exact backed up state they were before being wiped. But that seems to be unwanted by Apple and Google...