At my current org, it was hinted to us that if we tied (email forwards, etc.) or added any work account to a personal device, that the personal accounts and device could be subject to audits.

Don't mix your work and personal stuff. Keep it separate, keep it safe.