The key requirement is toinstantly eliminate data losson a lost device.
Cryptographic erasureworks by deleting encryption keys used for FDE (full disk encryption), rendering all data unrecoverable within seconds - satisfying the "mitigate within seconds" requirement.
Revoking certificates won't wipe the data from a lost tablet.
Changing MFA credentials won't help unless the device is secured, and app allow lists don't apply post-loss.
FromCAS-005, Domain 3: Secure Systems Design and Deployment:
"Cryptographic erase (CE) renders data irrecoverable by deleting encryption keys used to protect data on the device."