This is true. The only plus here was that you do know exactly which users did it. LAUSD stated that in the article too. They know exactly which devices had their MDM profiles deleted. The user is in control, but the MDM can notify what the user did.
At that point, it should be a disciplinary issue. Unfortunately, in this country, it becomes a legal/lawsuit/CIPA issue.