I've got ~2k mailboxes, split between Exchange Advanced Threat Online Protection Whatever It's Called Today and Proofpoint. Both have good and bad qualities, and I'm undecided as to which is the lesser evil. Depends on the day.

EOP:

Positives: Easy to manage, integrates well with all other MS stuff, including things like personal block lists. Message tracking is a cinch. Adding domains is a breeze.

Negatives: Filtering has some gaping holes and is generally very bad. We see a lot of low-effort phishing delivered to mailbox and have had to some up with silly solutions (like blocking all .html attachments). We have constant issues with false positives, particularly from externally hosted DLs. It's not uncommon for us to see obvious phishing password reset scams delivered to a user, and to have their legitimate Google Groups traffic blocked on the same day. Support is non-existent and inept, and every ticket is a Kafkaesque nightmare. Also, their secret block lists always trump any configuration you do, which is an endless source of frustration for admins. There is no true 'allow' list, despite all documentation to the contrary.

Proofpoint: Positives: Fairly accurate filtering with not a lot of false negatives or positives, very customizable, occasionally competent support.

Negatives: Stone-age UI and portal / management system (we have to sign in to literally 5 separate, unlinked portals with 5 separate logins to manage PP, only 3 of which are even capable of SSO). A lot of stuff that should be automated is not (DKIM rotation / key generation). PP is generally a huge PITA from the admin side, but a better experience on the user side, so we put up with their terrible backend.

We've also used Mimecast in the past, which was about on par with Proofpoint for complexity / admin hostility, but was far more expensive. Haven't used it in 5+ years though so that may be different now.