[mc32]

This all sounds reasonable but Google doesn’t use this strategy and it looks cleaner for the end user. So why can’t O365 do similar?

[kerng]

Not everyone equally applies security concepts and isolation the same way. Google is probably less concerned around certain web attacks compared to Microsoft. Microsoft isolates their corporation from customer things, which is good I'd say.

[repolfx]

Google does use it:

googleusercontent.com

gstatic.com

etc