Most email within a company’s domain is considered secure without certificates etc. Normally issues arise from out of network email.
That’s generally true and that can have link security, but it’s not really secure.