The difference between an enterprise device management feature and a web API are... pretty massive.
It doesn't seem particularly unreasonable that a company dealing with sensitive data would want to prevent their less computer-educated employees from falling for self-XSS attacks
