It looks like generations of implementations (and likely generations of product management and development teams) layering on top of each other, "replacing" the "old" systems to only do the half of the migration, and integrating with acquired products.
Seen from outside, it just doesn't look like there exists a single team that understands the authentication and permission system end-to-end.
I think some people are mixing up Hanlon's razor with "if it is bad, the malice part can't be on purpose".
Microsoft has been dealing with online identity almost since the consumer web exists. MSN launched in 1995, Outlook was the poster child of webmail, ActiveDirectory is the behemoth of enterprise user management.
I don’t see Hanlon’s razor relevant when it’s on one of their core competency. They at least committed to throw part of their users under the bus to pursue their goals.
For that reason I never use MS online apps on my private devices and whenever I need to sign in online, I always use the private mode or a dedicated Firefox container.