Egress filtering vs M365 Defender

This is more of a holistic question regarding the M365 Defender Suite, Defender Firewall, Windows endpoints and egress filtering.

It (used to be/is) best practices on an endpoint to block all egress traffic in Defender Firewall. Then you allow only the services/ports that are needed, e.g. 80, 443, ... to prevent any malicious software from calling out into the wild. There's always the fine line between usability and security, e.g. if Defender Firewall blocks too much users can't work properly.
On the other hand if that malicious software calls out to/on port 80 or 443 that egress rule wouldn't work.

Doing egress filtering on a hardware/virtual appliance (firewall) might be better spot in the network but with everything I know so far about the M365 Defender products (MDI, MDE, MDO, MDCA) I would assume that egress filtering on Windows endpoints is not necessary as M365D takes care of covering the entire kill chain (best case scenario).