macOS or Windows can be similarly locked down. In the schools, the school locks it down. In many companies, there are management tools like JAMF, InTune, or NinjaOne that lock down laptops, desktops, tablets, and cell phones a little or completely.
With a Chromebook, there is one thing to lock down. On a Mac, there are a lot of things to do, because the whole point of it is that it's a normal computer.
Every decent Chromebook the past several years can run a full Debian. I’m guessing the one thing you’re mentioning is disabling that feature. There are still client-side firewalls and some other settings to change to lock it down further for a school.
On a Mac, you do need to set up multiple settings in your JAMF profile but it’s only one JAMF client run to apply all the rules.
