You're not wrong, but Microsoft's Exchange 365 does have a lot of knobs to control (https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/

You're not wrong, but Microsoft's Exchange 365 does have a lot of knobs to control (https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/exchange-online-protection-overview https://docs.microsoft.com/en-us/microsoft-365/security/offi...) and the defaults are more relaxed, probably as concession to those migrating from on-premise solutions. I'm guessing that they turn the knobs into the most aggressive position for their personal services.