My apologies. I felt a little like you were agreeing with the previous commenter (“no nefarious software”) when you were talking about Autopilot, and I thought it worth pointing out that your employer certainly can install “nefarious” things even if they didn’t directly provision the device for you.
Of course I know that a lot of work still goes into setting up Intune so that your Autopilot devices are fit for use!