1. Blocking older known malware still blocks them, so that’s good (and saves bandwidth because the connection never happens, so this is really good).
2. If the site is hijacked, it needs blocked till it’s unhijacked. So this is good as well.
3. This is not really a point?

Number one above, stopping the connection before it happens, is really the best benefit, in my opinion. And if they boast a high false positive, you need better lists. You keep saying “they don’t block this or block that.” They are (nothing is) a one stop shop. Simply because they don’t block what you’re cherry picking does not make them bad. Use multiple layers. You say “don’t use a blocklist, use MS Defender instead.” Why not use both the blocklist, MS Defender, and even more stuff? Multiple layers. Defense in depth.