One can drop read-replies and even out-of-office auto-replies without dropping specific DSN's. It is up to each organization how they wish to handle these. Some financial institutions will go full BOFH Bastard Operator from Hell, like me and some will cherry pick what goes through such as limiting responses to employees. Some will let everything through to justify the purchase of their anti-spam, anti-malware third party service. I was brought into existence in the 2150th level of hell.
So that is the cool thing about such rules is that one can cherry pick whichever meets the needs and requirements of their organization and this is just the beginning of what one can do. The first step in this process is to enable logging of Subjects, Attachment Names / Sizes, FCrDNS and others to syslog then start building reports to see what is leaking out of ones organization and what nonsense is flooding ones organization. Some DLP's Data Loss Prevention appliances can do some of this too but they can be pricey and may leak data to yet another third party. As a proper BOFH I keep logs in-house. Logging to a third party can get extra painful with newer privacy laws in some countries.
I always front-end exchange servers with multiple Postfix servers with large queues so that work can be done without losing things, extra logging can be enabled and extra anti-spam capabilities can be enabled or added.
