Verify that work accounts are only added by device owners or profile
owners.

For instance, Microsoft Intune will create a work profile (moving itself
to the work profile in the process) before using the work account servce
to create a work account, so at that point it will already be profile
owner. Apps that are not the profile owner will subsequently not be able
to disable the work account authenticator or remove the work account.
The personal account would not have an owner and thus no application
could enable the work account provider there.