Quick test to check if a company is engaged in pseudo-security practices that only makes the life of their personal a hell: do they use two-factor authentication using SMS codes? If yes, there you have it.

Usually, companies like that signs for the full bullshit package and goes all in MS 365 cloud solutions.