Securing usernames/passwords and handling second factors etc; is already done so well and it's hard to do.
Having a clear 'this is where we can be secure' stances is what makes me want to trust them more.
And if you for whatever reason get locked out of your microsoft account (and I say this as someone who had this happen with a Google account) your are basically locked out of your online life.
I own my own domain for my email address (xxxx@mydomain.com). As long as I can set the MX record of that domain freely, I can always restore access to my email adress no matter what any email provider decides to do or block me for.
Account issues, recovery, support that can be manipulated, a single breach or bad password that grants access to their admin interfaces, implementing their own 2FA.
And, serious people want SSO anyway, and most people have some kind of authentication they can lean on.
You can make a stodgy password login if you want, or you can run a keycloak yourself.
If you don't want to run an OIDC provider for yourself, why would you want them to?
Genuinely I applaud the idea that they're SSO first, and have as little information as possible to handle things. If you don't like it; well, run your own, run headscale - or, use wireguard another way.
Not every company needs their own login system. I fucking hate it.
If you trust your email provider: Ask them to set up an OIDC provider then.
Email is insecure. I can't be the first person to tell you this.
Multiplying your logins is not more security, it's less in the majority of cases.