If you're running a single forest with/or a single AD/domain I'd argue that Microsoft has done nothing wrong. Separation of concerns has been a thing for decade

If you're running a single forest with/or a single AD/domain I'd argue that Microsoft has done nothing wrong. Separation of concerns has been a thing for decades now. And no, I'm not suggesting Microsoft's stuff is above reproach.