“But without that stuff, are they any better than a network security group when deployed in Azure?”
I would say probably no. ;-) The built-in proxies that don’t need a subscription can verify compliance to the protocol. It’s good to have but has limited use. The subscription services are where it’s at, IMO.