But this absence of basic travel cybersecurity is a problem. Email is the number one threat vector for socially engineered attacks. An automatic reply message not only sends the information to designated contacts, but it also bounces back to people who send phishing emails. Threat actors use any details found in OOO messages to craft targeted social engineering messages. Well-targeted messages build trust that threat actors take advantage of.
Very true, if the options came in reverse order (or maybe emergency first followed by not-urgent followed by urgent) that would be a little better.

I have a coworker who has an “always-on” autoreply stating that she “is busy with client meetings during the day” and therefore only checks emails at 9am and 3pm. I understand wanting to set the expectation that people won’t get an immediate response, but it really baffles me. If you are still able to respond within 24 hours, why does anyone need this information? To me it feels like some weird self-help tip or power move that they read somewhere that serves no actual function.
Thank you for your message. I am currently out of the store on holidays, with no access to email. I will be returning on (insert date).