I agree completely. My feeling is that software vendors/publishers should have all available security in place as a foundation and always up to date. Possibly a spurious equivalency, but imagine any motor vehicle manufacturer providing a vehicle with brakes, airbags and steering that are very effective 90% of the time. But geez, that leather trim is primo and that touch screen infotainment system is always updated. Security should never be a cost option.

You can get M365 Defender for O365 plan 1 and plan 2 as add-ons at not a bad cost, so at least there are some other ways than just getting M365 E5.

Yes this is absolutely true. Definitely another option that can be considered.

It’s also perhaps worth pointing out that the most requested feature in this list isn’t exclusive to M365 E5 and is accessible via AAD P2 licensing – sure it’s not as cheap as being bundled in with E3 if you already have it, but it’s not an E5 like cost uplift and includes AAD Identity Protection which then allows the evaluation of user and sign-in risk levels in Conditional Access policies and other benefits.

Worth considering that as an upgrade, even if only for a subset of users (admins and senior staff).