> every job I've had, if you actually looked at the IT policies, they were all very clear that work devices were for work, personal devices were for personal stuff

There's quite a difference between that and zero privacy, and there's also quite a difference between "IT policy says" or "the law permits" and "this is how things ought to be".

That said, between necessary endpoint security and the potential to get caught up in corporate legal disputes I feel like maintaining a strict separation is advisable. But that doesn't mean I support unnecessarily invasive surveillance or think it's a good thing.