It’s an interesting write up. But I don’t think it’s valid for one reason, company devices often require a company certificate to be fully trusted so that the company firewall can inspect all traffic transiting it.

So there must be a mechanism that allows corporately managed Android devices to adhere to corporate firewall policies.

Not just corporate, there’s some countries that require you to install their certificate before you can use the internet.