When COVID-19 hit, the only prep my employer had was that everyone had laptops and we had basic VPN infrastructure. The first week or two were chaotic. Everyone had to provide their own high-speed Internet. Eventually they let us come in small groups to the office to bring home monitors, keyboards, and mice.

Our company was never BYOD, but they were pretty loose about personal hardware. They didn't provide or require phones, but to get office mail, documents, etc. you had to have management software on your phone or tablet. You couldn't connect your own computer to the VPN.

We came back to work in mid-2021. In early 2022 we had a ransomware breach on a Sunday evening. If you happened to have your laptop with you (I did), you could eventually do some WFH stuff, after certain servers were certified clean (they never told us, but indications were someone succumbed to a phishing attack). Otherwise you were SOL until they either certified your machine had been turned off or was otherwise certified clean, or you got a brand new laptop.

Once we were back in the office (again), things were stricter...no USB drives allowed, for instance, and software installs were more tightly controlled. But the phone/tablet policy was the same -- even if you were on call, you had to provide your own phone. MFA could be on your phone or software on your laptop, and again you weren't required to have company software on your phone.