PSA: No lock-screen widgets with ActiveSync enforced device lock

It appears that with Android 4.2, if you use corporate email (ActiveSync) and it forces a PIN or password lock for the device, you cannot configure lock-screen widgets. It appears forcing a PIN/password on the device also forces "Disable features in keyguard", a new and seemingly undocumented device admin permission in 4.2 which seems to make it so you cannot configure the lock screen widgets, leaving you with just the clock.