IT can lean on the vendor to fix their shitty software.

If the head of IT doesn't want to do that, the department is dysfunctionally managed and does not have my sympathy.

Beyond that, I don't really care what policy is. While I generally don't care about company nannyware - after all, it's your machine - the line is drawn when you are literally burning my body. If you want me to use the device, it can't cause me physical harm.