Not knowing the law in the US I guess it is fully legal. Given that there is no union or chain responsibility in the supply chain or similar to GDPR in EU you guys are fucked until someone abuse the system one way or another.
On the other hand it shows work from home is feasible even with these kind of things.