I would be surprised if break rooms or cafeterias could be legally bugged without displaying a prominent notice where I live.
That said, I totally agree about company phones and email addresses - those are under employer control and so could never be trusted, which is why the side-channel would be something like an unofficial WhatsApp group of a few co-workers who know each other well. Brain implants are not part of the threat model just yet, and I was sharing my observations purely in the context of my own recent experience.