My apologies. I felt a little like you were agreeing with the previous commenter ("no nefarious software") when you were talking about Autopilot, and I thought it worth pointing out that your employer certainly can install "nefarious" things even if they didn't directly provision the device for you.
Of course I know that a lot of work still goes into setting up Intune so that your Autopilot devices are fit for use!
Receiving a Windows Autopilot device direct from the manufacturer or vendor in no way prevents your employer from installing whatever software they want on the device, of course. I can't speak for the Apple device but I would imagine there are ways to remotely manage the device even there - requiring the employee to sign in to Jamf, perhaps.
Great comment. I ran dd-wrt for years, but finally picked up a used Ubiquiti router and purchased the Eero Pros for wifi. Software does the security now.
I haven't been able to find a way of viewing where filters work at all. Are they broken, or do they only work in specific circumstances?