As long as the devices haven't been released from the Apple Business Manager account for the organization, IT can disable both User-Initiated (Locked to a user's personal Apple ID) and MDM-Initiated (Locked to the ABM Apple ID) Activation Lock. That's not a good reason to stop users from logging in to their personal Apple IDs on the devices. Most of my org's user-assigned macs/iPads allow the user to log in to their personal Apple ID, and I've never once had trouble disabling the Activation Lock--even if the device was wiped before disabling it.