Microsoft secures the platform, but you are responsible for how it is configured and who has access. Out of the box, MFA may be optional, external sharing may be open and nothing is stopping a user from emailing a spreadsheet of client records. Data security is about closing those gaps.