The phishing that gets through is the phishing that looks like business
Microsoft 365 filtering catches the obvious. It does not reliably catch an invoice from a supplier whose own account was taken over, which is the attack that actually costs practices money.