Eh, it doesn't need to be, you just need to do the work of putting together granular access controls that can account for your risk profiles.

The risk isn't much different between a company owned telephone and a personal telephone.
They're both susceptible to most of the same attacks, or being left on the bus.