

If you think you can set up mail infrastructure with on premise everything that is available to your not on premise workers safer than Microsoft, you will be spending a huge amount of money to do so.
Even if they prefer not to self-host, there are plenty of providers out there that are more trustworthy than Microsoft. In fact, I would say that a medium-sized established company that derives most of its revenue from providing email and related services is likely to secure them better than an oversized tech giant that just does email on the side—they have more incentive.
My primary browser profile allows only whitelisted cookies. It also allows only whitelisted Javascript, so I don’t see the popups. If this breaks a site beyond usefulness, I seriously consider whether I really need that site (and if it falls into the <2% where the answer is “yes”, I either whitelist it or open it in the window for the other profile that functions on a blacklist basis).
That’s a lot more manual management than most people want to bother with, though.