Overheard in a lab today. During the upgrade process of 10.15, a Mac will automatically enable the Activation Lock feature if they meet the following requirements:
iCloud Account logged in
Not Supervised (DEP)
If the Mac is Supervised then you can manage whether or not the Activation Lock is enabled. As well the only way to Escrow & Reset the ActivationBypass is if the system is Supervised. As it was explained, unless the system is Supervised there is no way to verify if it is an institutionally owned system or not. If your T2 systems are not tied to DEP/MDM this would be a good time to start that process.