I get the impression that this is a temporary measure to ease the transition, not a statement about the privacy guarantees of M365.