EAC Restrict Access does not work for Exchange 2016 via iApp

Should BIG-IP APM restrict EAC access to members of the Exchange Organization Management Security Group? Yes, restrict EAC access by group membership

seems to me this is around the wrong way around and doesn't match anyway. or am i missing something?

So in theory this is meant to block ecp to users who might change personal details, members of groups they own or wipe their own phone which got stolen. Where as we allow admins full access to change smtp routing, any policy they want, disable access to all other admins... What I can't understand is when and why would I want to do that?

Surely it would make more sense to block ECP access to Admins via the the APM and iapp and allow normal users access.