> I'm surprised that (particularly non-US) regulators are not investigating them yet.

Because corporate managed phones are required for all the id crap governance franchises intend to foist on people.