Bring-your-own-device policies look attractive on paper. The company saves on hardware. Employees get to use the machine they already love. Everyone wins, until you have to do something to a personal device — install a security policy, enforce encryption, wipe company data when somebody leaves. At that moment, the convenience evaporates. The employee doesn't want their family photos behind a corporate MDM. The company doesn't want a single employee's personal-machine breach to expose customer data. Both sides are right.
Apple's answer to this is User Enrollment, which is sometimes also called Profile-Based Enrollment. It's a separate enrollment mode in MDM that creates a managed Apple account on the user's personal device, alongside their personal account. The managed account holds the company apps, the company data, the company configurations. The personal account is untouched. When somebody leaves, the managed account is removed — taking the company data with it — and the personal account, with the family photos and the iMessage history, stays exactly as it was.
This is the right architecture for BYOD on Macs (and on iPhones — the iOS version is more mature, but the macOS version got real in Sonoma and is good enough to deploy). It separates the company's interest (controlling its data) from the user's interest (keeping their personal machine personal). It removes the awkward conversation about what the company can see on a BYOD device — the company can see and control its managed account, nothing more.
What this requires on your end: an MDM that supports User Enrollment for macOS (most modern ones do — Kandji, Jamf Pro, Mosyle, Addigy), a documented BYOD policy that's actually written down, and a clean offboarding workflow that removes the managed account when somebody leaves. The companies doing BYOD without User Enrollment are either (a) accepting risk they haven't named, or (b) running fully-managed MDM on personal devices and pretending it's BYOD when their employees would object if they knew. The new pattern is genuinely better. Use it.