One great feature of gsuite, in my opinion, is the ability to prevent oauth-authenticated access to the email APIs, IMAP, and POP for your organization. These shady apps are ALL stealing your data. Literally every single one of them. And just telling your users to be careful about what apps they use isn't going to cut it, someone in your organization will leak everything.