Update: Starting November 2022, protection.microsoft.com URL does not work anymore. Please go to security.microsoft.com instead for the AntiSpam feature mentioned in this post.
We realize that many...
Updated Dec 08, 2023
Version 10.0
Blog Post
I finally worked out the answer to my questions above and my apologies for not comprehending this excellent article properly in the first place, we had 2 remote domains configured to allow forwarding, which is actually why the forwarding worked on those shared mailboxes.
A couple of suggestions to help alleviate future pain & understanding
Is there any update on when you are going to remove "automatic: System controlled" which is the same as "off" ? as this does not help with understanding when people are trying to work this all out.
In the Security/Defender/Protection/(WhateverItIsCalledThisWeek) console, could you add a note to the Anti-Spam policies to say that Remote Domain policies can also control forwarding as well please.