[pasbesoin]

Part of my argument is that, when you as an individual are on one end of an argument about this with a substantial business/corporation and/or the government, you are going to have a rather difficult time, regardless of what is "right" and "lawful".

Better to be able to hand the device over and say, "Have at it."

Also, if there is some breach of security and a question about whether you facilitated it, through activity or through negligence, better to be able to say/demonstrate to the other party: "It's the organization's device, and the organization's / the organization's IT department's responsibility to maintain it."