Its not hyperbolic. I wrote the policy for my company's phone policy. If an employee wants to access any company resources from their personal phone (optional) they must submit to a phone audit. The audit is a checklist of security best practices including verifying that the phone is receiving security updates for the OS. So if they need a phone for work, they either upgrade to a newer phone or carry a second phone with security updates for work purposes. Either way they have to get a new phone. What else would a company do? You can't just have employees storing credentials for company accounts on a device that is likely to get pwned.

Personally I don't see how anyone could justify having an out-of-date phone. Assuming you have it configured to read your email, it becomes a gateway to every account you own, which can have its password reset over email. MFA might help as long as that MFA isn't an app on your phone. But most websites don't support hardware security keys. If you care enough to have a dedicated TOTP device, then why would you want a phone with no security updates?

This use of "forcing" does not require bricking the phone. Creating a situation where the only reasonable choice is to upgrade the hardware qualifies as "forcing" in my opinion. The phone is no longer capable of performing the job for which it was designed in a safe way.