FWIW, they put a header in the message that you can spot from a thousand miles away. That is how they get past the filters.

I used to work for a company y that used them, and this trick was passed around between engineers as a way to tell. They didn’t bother checking the results of whether we flagged them as spam, so ultimately we found that we could just ignore them completely.

It’s compliance theater. No real security is gained, but it checks all the boxes.