I managed O365 for my last employer and we enforced exchange login. Granted we were part of the defense industrial base and would fall under your exceptions, certainly. But, if a company is making even a minimal effort to prevent company data ending up on unmanaged devices its a nobrainer to disable imap, as much as it sucks for the end user.
In the end we did have to make singular exceptions for certain developers because outlook’s absolutely pathetic plaintext support was causing issues when they were contributing via the LKML. But that was a significant business justification as opposed to a workflow optimization.