Secure Score-Security & Compliance

Actions from Secure Score aren't absolutes, they are items to be reviewed and possibly implemented depending on the particular environment.  It's about getting a balance with improving security while retaining productivity for end-users. 

Advanced Threat Protection (ATP) is included in the E5 plan but it's available separately as an add-on for most other plans including Office 365 Business Essentials. Further details are availabile https://products.office.com/en-us/exchange/online-email-threat-protectionby the way.

There are some upcoming features to look out for as well, some details in this post.  A couple of other resources well worth checking out, the https://channel9.msdn.com/Events/Ignite/Australia-2017/PROD321 (really good recent presentation) and perhaps my own https://social.technet.microsoft.com/wiki/contents/articles/36430.office-365-secure-score-find-and-fix-risks-in-office-365.aspx article. 

Finally, no Azure AD Premium License doesn't come into it, that a different feature set as outlined in this page - https://docs.microsoft.com/en-us/azure/active-directory/active-directory-editions.