It also depends what service you use for mail, how big your organisation is, risk profile etc. E.g. Smallish business using Office 365 or Google Workspace you can setup 95% of what a 3rd party security service can give you. The biggest difference is typically in the reporting/auditability/ease...