You still do not fully understand. Zero-Touch Deployment means they can still have full access to the Mac even via a reseller. If the employer purchased the hardware they own it and can manage it. Any employer who doesn't do this is accepting a massive risk to the company.
There should not be a Profiles icon in System Preferences, if you see it then the Mac is managed. However, it may be hidden from view so you can open Terminal and type "profiles status" and/or "sudo profiles status". If it comes back with anything other than "There are no configuration profiles installed on this system" than you are likely managed by an MDM (Mobile Device Management) server.
- An employer registers with Apple Business (formerly DEP) they have validated their identity as a legit business with Apple. They were issued a code to use when procuring Apple hardware. That code can be provided to most all resellers or Apple themselves when purchasing hardware.
- The purchased device's serial number and other identifiers are now tied to your employer and identified by Apple as being the owner of the equipment. Before the hardware even ships from Apple or the reseller.
- Your employer will have setup an MDM (Mobile Device Management) server on the Internet. In Apple Business the employer defines that MDM server.
- All Apple devices phone home to Apple during the setup wizard. If they were purchased with that identifying employer code then they are routed to the employers MDM where the device auto-enrolls to the MDM without user approval. The device will be considered owned by the employer until the employer removes the device from Apple Business.
- An MDM Profile is pushed to the Mac without user approvals required and it has the highest privileges possible. This is because Apple knows it belongs to the employer and the employers MDM is fully trusted by Apple. The MDM then pushes additional profiles, certificates, and policies. It can install software, lockdown features of the operating system, create administrative accounts, etc. It's possible to hide most of this from the user.
- Whenever the Mac is on the Internet it is checking into the MDM at a regular interval for new policies and running an inventory. Any new policies applied by the employer would be delivered at the next check-in cycle. Configuration Profiles are applied in seconds. VPN is not even required. The employer has full and complete administrative control of the device remotely.
Perhaps your employer is not managing your Mac but it is far more likely that they are. Any employer not managing computers owned by the business is taking a huge risk. This is the way most company Macs are managed. There are several MDM server products on the market even a few free ones. An employer decides how far they want to go with managing the Apple devices they own. Some are very strict, others are very relaxed.
If you find there are configuration profiles installed on the Mac then Big Brother is indeed watching you. It is not your personal device and you shouldn't treat it as such. There should be zero expectation of privacy with employer owned hardware.
Apple did add a BYOD (Bring Your Own Device) MDM feature recently and that's considerably different. In that scenario you as the owner of the Mac voluntarily enroll with your employers MDM. Allowing the initial MDM Configuration Profile. However, if implemented properly this is a limited MDM enrollment. The employer can only manage very limited things and cannot even pull the serial number of your device. But they can configure VPN, install apps and control the apps they install as well as any work related data. You have a lot more privacy in this scenario. Corporate items are sandboxed from your personal data. There can be two different Apple IDs, personal verses corporate. If you leave the company you simply remove the MDM Configuration Profile or the employer does it remotely. This destroys all the corporate data on the device without touching your personal info or files.
