This is a legit question though. IT departments will always protect themselves by urging the most complaint approach, which favors the supervised device here. However, their reasons for imposing a device profile may not elide with their reasons for providing an employee with cellular service. Moreover, there's probably not a strict policy against using the SIM card in a non-supervised device, in part because the issue may not have come up previously.
In light of all that, I think the original question is worth considering: Completely apart from what company rules hypothetically may require, could using the SIM card itself trigger a notification to the company? Is there a technical reason why using the company SIM card in a personal device would be problematic?