This is even worse. For instance, in a medical university, we recently were told we need a smartphone and install an app from Google store (!!!), in order to read emails sent out by officials at the medical university. I protested to that but they had a deal already with the private company and their signature meant they had to keep on being addicted to that private company, so now I am locked out of receiving emails since for redirect you also need to have that app installed once. I don't have a smartphone though and I find it outrageous that people are forced to install it AND forced to use Google Store, for publicly funded (!!!) universities here in central Europe. Some lobbyists are currently getting very rich. I call it theft of taxpayer's money though.

Imho, the missing component here (in both the EU and US) is an individual right to access covered services.

Where "access" is specifically defined as full functionality on a device of an individual's choice, and offers safe harbor for example options. Like HTML over HTTP (without javascript) or REST APIs.

This should be built on top of existing accessibility requirements, with the goal of preventing not having a Google / Apple smartphone from being an access barrier.

"Covered services" should be defined two-fold, either by market share above a certain threshold or services that are required for normal life/studying/work (and tied to any public funding).

It should be default illegal for entities to make bargains with Google/Apple (or app developers) that exclusively rely on certified devices, except for extremely limited special circumstances.

What country? Which university?

I don't know where you are, and I'm not an expert, but a job requiring specific technology typically means it is your employer's responsibility to provide that technology. So if they signed a contract that mandates you have a smartphone, you can use your own if you like, but I think they are legally required to provide you with one if you choose not to buy one. In fact in most cases, I think they should prefer that (since the security of your personal device is very much none of their business).

I think this is kind of a ticking time bomb with a lot of companies depending on personal devices for 2FA.

Which is exactly the point of the whole "sovereignty" debate: on one hand there's a lot of slop about "national interest" and "privacy" and "features" and such, and on the other hand management decides for whoever offers something (anything) cheaper and with a golf tournament on top. And then everybody moans and complains about the situation.