There’s a difference between using a web browser to access certain websites, which still use the sandboxing and safe environment that the company has set up, and running your own OS which has unrestricted hardware access to everything.
IT likely knows that people will use their laptops for personal use, but probably trust that browsers are good enough at sandboxing that is not a concern. They can also tweak settings in whatever Windows management thingie they’re using to ensure that everything is up to date and all the programs you are running are safe.
However, running your own OS is very different. They can’t trust the browser sandbox or OS any more. They can’t trust that you’ll only run safe software. They can’t trust that you’ll not install malware that will infect firmware or your Windows install (which will steal company secrets).
If I were running an IT department I’d 100% lock down the efi and require a password. I’d try to make it as frictionless as possible if you wanted a certain distro for work reasons, but ultimately I’d like to know what’s going on.