My apologies. I felt a little like you were agreeing with the previous commenter (“no nefarious software”) when you were talking about Autopilot, and I thought it worth pointing out that your employer certainly can install “nefarious” things even if they didn’t directly provision the device for you.

Of course I know that a lot of work still goes into setting up Intune so that your Autopilot devices are fit for use!

Receiving a Windows Autopilot device direct from the manufacturer or vendor in no way prevents your employer from installing whatever software they want on the device, of course. I can’t speak for the Apple device but I would imagine there are ways to remotely manage the device even there - requiring the employee to sign in to Jamf, perhaps.