The "You must release changes"-clause and anti-tivoization clause might be not be enough individually to switch to MIT zsh but probably were together good enough reasons for Apple to switch.
Again, perhaps it is because Apple is planning for a future where SIP and Gatekeeper cannot be turned off. A future where macOS is basically reduced/merged to iPadOS. Time will tell.
A company or school can already do this easily, by the way, by setting a boot-loader password and restricting admin access. Notably, this are normal macOS functions, you don't need a fancy mtm setup.
IANAL, but I really don't think so. On a company laptop, the company owns the laptop, and the company can lock it down as much or as little as they want.
