If you think you can set up mail infrastructure with on premise everything that is available to your not on premise workers safer than Microsoft, you will be spending a huge amount of money to do so.

Even if they prefer not to self-host, there are plenty of providers out there that are more trustworthy than Microsoft. In fact, I would say that a medium-sized established company that derives most of its revenue from providing email and related services is likely to secure them better than an oversized tech giant that just does email on the side—they have more incentive.