I’ve always thought it was to head 'em off at the pass so they won’t install un-remotely managed and un-monitored Linux distros on company equipment.

For me it's not working. Every day of having to use macOS drives me closer to doing this. It's such a fucking annoying system, even after 2.5 years :-D