No way they could ever pass an ITAR or SOC 2 audit with employees using their own machines. Data security is critical part of these governmental frameworks and having a set of controls in place that companies must comply with if they are to be certified. Keeping ITAR data on an employee's personal PC that is open to the internet is probably one of the biggest no-no's I can envision.

It amazes me what supposed SOC2 "compliant" companies are willing to skimp on. A recent employer of mine, also regulated kept fighting me on getting me a work laptop. Also another funded SF based startup.