" I at least assume MS has some automated code standard or security scans." -- that is a .... big assumption.
https://arstechnica.com/security/2023/09/hack-of-a-microsoft...
The Azure-State-Department breach had nearly a half dozen contributing bugs...
So yeah, assuming Microsoft systems are up to standard or have security reviews or whatever is a .... big assumption.