Modern MDM solutions use Apple Business Manager to automatically deploy the MDM after a system wipe. If you have a company owned Apple device, and the company has it enrolled in ABM, then you can wipe and filevault all you want, but the agent will still be reinstalled, and the file vault key escrowed.

Yeah I know. It's not like Apple is trying to hide it or most companies try to hide spyware, and I know how to check for Apple business manager or spywares.