I can understand the problems of phishing etc. for probably the majority of email users at a large institution...but then you have every link rewritten to look

I can understand the problems of phishing etc. for probably the majority of email users at a large institution...but then you have every link rewritten to look stranger, and tons of data (links sent, clicked on, with all the metadata of that) in the hands of a 3rd party. I don't think this is the right solution, is this really the best we can do right now?