Security Issue: Win 11/iPhones/Phone Link/User Accounts work&private

Something strange happened recently. I had a work laptop with a very generic password to open it to the "Admin" user ( the only user set up by my employer - literally "0000"). As I was using it I downloaded 2 apps for work: Whatsapp, which my employer uses for all communication between employees, and the Phone Link app, which I had linked to our work phone (iPhone 11).

Additionally, sitting in my pocket, I had my iPhone (the iPhone SE), which had Phone Link on it already, but was connected to my laptop at home.

Important: I never entered my username/email/password into my work computer.

The Problem: At some point, the work computer started showing the image of a flower I have saved on my laptop at home on the open screen connected to my user profile. Sign in didn't change at all (no password change), but the image did. Then everything Microsoft on that work laptop was converted to all my information: Private banking, all my bookmarks for my Edge Browser, Microsoft Store, and Phone Link. I couldn't even remove the work Phone Link profile from my personal iPhone. I had to go online to Microsoft to manage users:

https://account.microsoft.com/devices

https://account.microsoft.com/devices/content

https://account.microsoft.com/security

And indeed my work computer was listed both in the Microsoft Store, My Devices, and in the Phone Link settings in the app (where I couldn't remove it). I removed all the work related devices and changed my password.

I asked AI explaining what happened and this was the result:

Via AI:

"That's actually the most common scenario. You almost certainly didn't type a password — Phone Link silently inherited an already-active session. Here's how:

The Microsoft Store is the usual culprit. If your personal Microsoft account was ever signed into the Microsoft Store on that work laptop (even once, to download any app), a valid session token stays cached. When you opened Phone Link and clicked through setup, it detected that existing Store session and used it without prompting you for a password at all. You'd see a "Continue" or "Sign in" button that just… works, with no credential entry.

From a Microsoft Q&A thread confirming this exact behavior:

"The unwanted email showing in Phone Link was signed in the store app."

Another thread adds: "Phone Link saves your account info with your Windows user profile, and sometimes your Microsoft Store account too."

So the sequence was likely:

1. At some point (possibly during initial IT setup, or when you downloaded something), your personal account got signed into the Store on the work laptop.
2. You opened Phone Link, clicked through the setup, and it silently used that cached Store session — no password prompt.
3. Windows then associated your personal Microsoft account with a local user profile on the machine."

My work laptop with Phone Link was actually showing then my personal phone and conversations and not the work iPhone I had linked originally.

I need some input as to whether this has happened to other people. It seems like a massive security flaw - I didn't sign in and now my employer suddenly has all my personal info from banking to phone conversations on their laptop which is totally unacceptable.

Additionally they are accusing me of browsing while at work, but all that information is from my home computer where I was doing my banking and other work on Edge. They just aren't tech savvy enough to figure that out and just see all the links.

I was never given any info from my phone or any of the Windows apps or OS that it was migrating my data to that computer. It just did it. Is there a way to block this from happening? Have other people experienced it? To me it's terrifying and inexcusable that there would be such a flaw.