They might have a BYOD policy at work where they remote into an azure desktop or something and then reinstalled Windows on their physical device. Who knows. But yeah, they still should have notified their security personnel at the very least before taking any further action, lol.