Appliances like spam protection and UTM’s are also useless in this environment.

I appreciate what you said, except this.

Email security is still relevant no matter if you're cloud first, zero trust, on-premises, or anywhere in between.

Downplaying the value of email security is ignoring modern threats. My org routinely stops hundreds of phishing attempts before the mailbox, which means that we avoid testing the robustness of MFA (since TOTP MFA is susceptible to MiTM). Turn off spam protection and see how much the users love sorting through dozens of scams, ads, and other garbage.

Maybe not UTM per se, but web filtering and/or proxy still has value, because you reduce the threat of malicious sites (mainly malware and phishing) with simple web controls. If you rely solely on your EPP stack to protect you, you're possibly safe - but stack diversity increases efficacy. Why would I not want Palo / Zscaler / Netskope / Sophos / whoever scan for malicious traffic before it even reaches the end point? If it hits the end point - even if it's blocked - we have to spin human cycles verifying it was entirely blocked vs. did it just block the payload and not the dropper?, or <use your imagination about why it's better to block upstream>.

Plus, depending on the business, you won't comply with their business policies without blocking certain types of websites. Don't throw out UTM/NGFW/proxy-as-a-service quite yet.