It's both that (which is reasonable) and on/against the general public (which is not).
Also, way too many people seemed to take the position of “oh it’s a company laptop so of course spyware is allowed”. It’s kinda gross how that’s accepted as “ok” - like if the company buys me a video camera or television for work that I can take home, it’s not ok if that fixed function appliance is reporting everything back to HQ. But for general purpose computing we’ve kind of accepted this breach of privacy without question. It’s really quite shocking (and no - it’s not a cybersecurity best practice to have spyware running on your employees devices).