I’m pretty certain their desktop client applies filters server-side.

I’m pretty certain because my company’s phishing-test emails skip my filters (I assume admins have a “skip filters” toggle). Which, hilariously, makes it even easier to ensure there’s a place that contains only phishing test emails (filter all not on allow-list of domains to one place, filter all on that list to another, ta-da, the main inbox now contains only phishing test emails)

I assume they do the same thing with non-MS email if you use their client, rather than maintain two filter implementations.

All around, yeah, wow, super gross.