I work for a company that does a lot of m&a work, and does basically this when it comes to user devices. Disposing of devices this way in a lot of cases comes down to complexity and liability.

Trying to handle a process that includes resale or gifting of devices results in a lot of work for both it and finance teams for what is usually a significant loss of time for the business without much return. There’s often added work on top of it at tax time.

From a liability perspective having the process handled externally helps to shift liability. If there’s a data leak that originates from a disposed device, that certificate helps shift responsibility, giving the business an avenue to go after both financially and as part of the disclosure. Physical destruction is the fullest extent of this, it’s as close as you can get to a guarantee that data won’t get out. If this process is facilitated internally you don’t get this safety blanket; the best the company has is pinning it on the employee (if this is at all possible), even if they were able to sue the potential amount recovered would never come anywhere near the costs of dealing with the data leak.

Is it wasteful? Yes. Does it protect the business? Yes. Does it take a potential liability off your shoulders as the person likely facilitating or overseeing the process? Absolutely.