This is the correct answer. If they want you to do any work in a mobile, remote, out of hours capacity, they need to provide the device.
I used to help manage MDM at my old company and I can tell you there is a shit load they can do once you install their utilities. For example:
- remotely wipe your phone
- block your ability to copy/paste between applications
- view all web traffic to/from it (even encrypted traffic since we installed a proxy that put its own trusted root certificate in)
BYOD benefits the company at the employees stupidity (and sometimes the only choice). The employee thinks “cool, only one phone to use!” but for the company it saves a lot of money and they still get the control they want. They don’t have a downside to implement it.