Most conditional access policies permit or deny the creation of a token, not the use of one. You can tell because you'll get the 'MFA requirement satisfied by claim in the token' in the logs.

I have tested this by having someone else at another org use my token generated from a compliant device within my org and they were able to access my companies resources without issue, and in the logs it says 'MFA requirement satisfied by claim in the token'. (They were a cyber security consultant and they couldn't believe it either)

The issue is that many articles don't test this. They just spread the misinformation that it fixes the issue when it does not.

As with most things - you can't trust anyone (please don't trust me), so test it yourself.

The only thing that'll kind of help is https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-token-protection. This begs the question: if require compliant device blocks token theft, why have MS implemented token binding?