There is antispam built-in but for our organisation we needed extra protection so we subscribed to ATP as an add on when we had Business Premium. ATP includes malware protection, anti-phishing, safe links and more. Well worth the few dollars extra per user. We have since moved to M365 which has even more security built-in including ATP. We also still retain 3rd party antivirus and web browsing protection.
