Yes, at our org we actually roll out/enable protections step-by-step and monitor the impact. We are conservative on cloud dependencies, but Defender Cloud protection components is only one of the very few we opt-in. Obviously it's just one tool in a toolbox, but under that umbrella there are very much protections that are very useful.

Tip of the day: Did you know that there are Attack surface reduction rules that can be enabled to, for example "Block Office communication application from creating child processes" https://docs.microsoft.com/en-us/microsoft-365/security/defe... ? :)