My point is doing all of these things is still not ideal if you don’t have intrusion/malware detection.

Malware shouldn't be able to run unless it's a zero-day browser exploit or your company relies on insecure file formats from external sources. Malware scanners do not help here - if they flag a file you don't know if it's a false positive and if they don't you don't know if this is a false negative. What you do know is, that such scanners have far too many permissions on your system and were actively exploited in the past. They can just be considered useless backdoors.

a breach/infection can still occur

But you realise that a breach is detected by e.g. Cyberhaven and an infection can't cause much damage with limited restrictions and protected file systems?

didn’t even include network segmentation

Holy fuck, when did we get from "clicks on a link" to a complete enterprise attack mitigation strategy including network architecture?! Shall we discuss how simply getting rid of Outlook/Exchange/Active Directory prevents 99.99% of intrusions already as well?