No, you don't need either of these companies if you need a corporate stack for communication and collaboration. And anyone who believes Microsoft or Google is doing anything out of the ordinary to protect their users or data is out of the loop.
We need actual liability laws for compute services at this point, and they should pass through every entity between the bits on disk and the end user.
Google disappears someone's realtor's corporate email, and it cost the agent a $100K real estate commission? Google and the employer get to pay $50K, plus damages to the customer.
Or whatever. The point is not that they'd be paying lots of these fines. The point is the cost of non-compliance and insecure setups is 1000x the cost of just doing their jobs. At that point, the bean counters would allocate another 10% to engineering, and all the easily-solved problems would disappear.
A lot of corporate (customer) email sevices drop email from everybody except a very short whitelist.