You have a valid concern and is why many cybersecurity folks have issue with BYOD.

The cost to the company is little because the employee is providing the device. That said in cases such as smartphones, where a company has a BYOD policy in place, most times it is assumed the employee already has their own device and if not the company usually provides them one if it is required.