> but what is the alternative? Google? AWS? Self host?

I mean, given this was possible:

> used a password spray attack to compromise a legacy non-production test tenant account and gain a foothold, and then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts

pretty much anything is going to be better than letting Microsoft host your email/corporate data