Access receiving rule

What i understand from the training video of Fortimail, it says if the sender is external and recipient is internal then Fortimail will allow the session by default, but for outbound email we need to create a "Access receive rule". 

But we need to protect our internal domains so why the default behavior is like that.