My completely unqualified outsider perspective is that they're a slightly different phenomenon. The old school Microsoft security issues stemmed from security being more or less an afterthought or with comically bad default options. Many years and many billions of dollars later those systems are largely OK. But of course onprem systems are often not patched - but that's arguably not their fault (although Microsoft have made patching much harder than it needs to be, possibly to drive SCCM sales I'm not sure).

Azure...is a whole other thing. Every single service I look at feels like it's been developed two or three times, and renamed at least once...with varying degrees of backwards compatibility/interoperability/deprecation. The security interactions must be a nightmare to properly test for MS. On top of this it feels like there's multiple strategies being enacted simultaneously which makes it hard as an admin user to know you're doing the right thing in general.

Other cloud providers undoubtedly have some of the same issues with complexity/change but AzureAD (now renamed to Entra ID for whatever reason) is being used to manage core things like user accounts and mailboxes for organisations of all shapes and sizes (often without internal security teams).

There's also an unpleasant feeling that security is an upsell opportunity. It's a bad look.