Compromising a single endpoint via a malware e-mail / link is just the first step of such an attack, you then need to move laterally in the network to get acces

Compromising a single endpoint via a malware e-mail / link is just the first step of such an attack, you then need to move laterally in the network to get access to the important bits of the infrastructure. For Windows networks this often involves breaking into the Active Directory / domain controller, which then gives you administrative access and makes it possible to e.g. encrypt data. This usually requires manual enumeration and specific exploits, it's not something that can be fully automated yet. So you're describing just the first link in a long attack chain. Eliminating that weak link doesn't mean the attackers can't gain access to the network, it just means they have to find another entrypoint, and in a real-world network where people need to regularly click on links and open untrusted documents it's notoriously difficult to plug all holes. Even the largest DAX corporations in Germany regularly become victims of cyber attacks, and trust me they spend a ton of money on cyber security and have thousands of people working on it.