I've seen it in action. It sucks. Take a paperless workforce who is all currently working remotely. Now put all the tax documents in place where they can *only* be accessed digitally via a company front end that requires a company laptop and a VPN. Remove any ability to print documents from that laptop to any source other than PDF or an in office printer -- and then make the in office printer inaccessible.
Now, set up the MS365 system to flag any outgoing traffic that contains PHI on it (like a Social Security Number), and immediately after you do so -- migrate your entire payroll system over to a new software platform, thereby making sure that anyone who actually wants to file their taxes has to download their documents RIGHT NOW if they want to have them available for use.
How does this story end? Well, imagine hundreds of employees making PDF's of their personal W2 forms, and forwarding them to themselves at home...