Helping users stay safe: Blocking internet macros by default in Office

How is MOTW managed for files received as email attachments (Outlook on Exchange Online)?  And is that behaviour different depending on who sent the email?  For example, would an email with a xlsm attachment sent from an internal colleague result in the file receiving the MOTW?

I've been trying to test the scenarios today, and what I'm seeing is that email attachments sent directly from a colleague in my company do not get MOTW, yet if I forward the same email out of the company and back in again, they do receive MOTW.

This is fine, and perhaps desirable to avoid business impact.  But what is annoying is that this behaviour does not seem to be consistent across all of my users.  Some recipients of the same email attachments do mark those attachments with MOTW, despite being in the same organisation on the same email system and same domain as me.

Any help to understand this behaviour would be appreciated please.