Copilot for Microsoft 365 Security and Governance AMA

Microsoft states "It’s important that you’re using the permission models available in Microsoft 365 services, such as SharePoint, to help ensure the right users or groups have the right access to the right content within your organization.” In an ideal world, zero trust is always best, do you really think M365’s permission models in most business is securely locked down well enough to let Copilot run free?