They don't need to take a corporate device with them. They need to have exfiltrated a credential during the (long) time they had alone with the laptop. You trust new employees' phones the way you decided to trust anything else: a risk assessment based on what the company is willing to bear, taking into account compensating controls like MDM.

Are you suggesting "no creds that live outside of trusted elements physically tied to a device we own" is an ubiquitous property of access management?