Exactly.
These services are containerised on personal devices so that its services can only be administered within the app container.
It has limited to no control over the phone itself or apps outside of its MDM container in the context of personal devices.