Don’t existing systems such as Microsoft 365 have cyber security in place for these sorts of attacks?

Microsoft 365 does have advanced in-built security. However, some attacks rely on human error, and these often can’t be picked up by software-based defence solutions.