I believe we’re making the same point from different angles:
I’m pointing out that companies I work with don’t exhibit easily identifiable characteristics to verify authenticity.
You (correct me if I’m wrong) are stating that bad actors will craft messages that look like legitimate ones.
In either case, we end up in a place where I would be unable to determine if a message is legitimate barring further out of band confirmation.
And what do those which come from scammers look like? In some areas, they are identical to those from the «large companies».