Well, where do you think they get their domain from? The same place you do, a registrar. You're just adding a layer.
For example, you mention hey.com.... do a `dig soa hey.com` and you'll see they're registered w/ cloudflare. If you register with cloudflare too, you will have the same chance of having your domain ripped away from you as hey.com does.
The email service provider isn't particularly special in that sense. That said, it is true that there's a lot about infrastructure people can use help with.
So, if you're not familiar w/ technicalities such as these I wouldn't blame you for outsourcing. It's a big world and we can't do it all ourselves. Good luck!