Comment by coldbrewed

There are much better ways of device enrollment; at a minimum they could require device activation that doesn't blindly use a token with no further checks.