Turns out that's not true, at least where I work. IT / Microsoft confirmed that all Copilot traffic goes through our corporate firewall.