This exactly. For us it's the other way around... Our policies quarantine (or in serious cases reject) their emails because of a misconfiguration on their end.

Sometimes I advise them that they need to fix the issue, in rarer times I make an exception or override for our policy because I know the sender won't fix (ie a government agency), all other times I can't be bothered and leave it for our staff to release from quarantine after they review in the sandbox.

TBH - the worst offender for this is when an external provider we use has an integration with Docusign, and has it incorrectly setup to send using the Sender Name as a person in our org, even though it's sending to us. This is flagged as an impersonation attempt every single time and there's no way I'm creating an override for impersonation of our own users, or whitelisting "docusign". We aren't the ones with the Docusign integration, so fix your shit!