It’s not lazy. They put a key on the vault with only a single key that can open it and gave that key to your friend. your friend then either gave that key away (got phished), made a bunch of copies of it and left them around town (reused passwords), or the rarest option he let a maintenance guy in who swiped it (installed spyware). None of that changes the fact Microsoft doesn’t have another key, but considering how that email is written it looks like another phishing attempt…