A twelve person firm, Business Premium, a sensible owner. Three accounts with no MFA at all. Nobody did anything wrong. Here is the sequence.
Microsoft's security defaults were on when the tenant was created, then someone turned them off to make a printer scanner work, meaning to put them back. Two contractors were added with the "skip MFA for now" habit. The third was the owner's own second account, created for a shared inbox and forgotten.
None of that shows up in the admin centre unless you go looking. It shows up the day a phished password is used from another country.
The fix takes an hour
One Conditional Access policy requiring MFA for all users, a break glass account excluded, report only for a week to see who it would catch, then on. The scanner gets an app password or a proper SMTP relay. That is the whole job.
If you want to know your number, the $250 Health Check answers it in two days.