They very likely dont have read or write access to the files on your device.
However, they probably do have the ability to remotely wipe the device. This feature is typically used in enterprise if a phone or laptop is lost or stolen to prevent bad actors from getting access to the data stored on the device.