About half the services in use, that require SSO login, are flagged as “external” when receiving emails. Along with the fact that quite a few of the services don’t use https, so all downloads from them (doc services) are flagged as untrusted in modern browsers.

Users are just used to ignoring the warnings designed to stop the majority of easily identified flags, because the actual work requires it.