Yes! But it is not a leash. It's the company network and data they are accessing. Security is the company's responsibility along with the IT Dept to implement it. Doesn't matter if using a company provided mobile device or a BYOD. If your site is a financial or gov't site there are many legal requirements you must meet to pass annual audits. Many SMB's are not up to speed on security. Smart personal device users might consider VPN for their own use, especially if doing banking or monetary transactions on their personal devices.