I mentioned this in the other post about LA schools, but there is a hole (bug?) in how Apple implemented MDM. There are two profiles installed with an MDM and while one is passcoded and can't be removed, the main one issued by the MDM company is easily removed with the click of the button. And when you remove that profile, both profiles are removed. This is a problem that Apple needs to fix. It's not the fault of any admin.