See the thing is -- they can't FORCE you to use your personal phone to enable 2fa for remote access, say., but you can be damn sure they'll have noticed you only averaged 42 hours of work a week when it comes to promotion, bonus, redundancy, "get rid of that guy, he annoys me" time, etc.