How Microsoft Measures Effectiveness of Malware & Phish Catch for Office 365

I don't like prioritizing junk mail folder over quarantine. I don't want spam or malware reaching my users at all. Period. So now i see Zap complaining that it can't do something because junk mail (which in the past had so many false positives so it still carries failure stigma for me and for many) is not used. What does it mean? Malicious email was let through? Exchange online can't sanitize it after the fact without needing junk mail? It is in the mailbox on the server. So why?