You can totally use emojis as passwords. You can probably even make this a policy at your company.
Edit: I thought this was an obvious enough joke, but just to clear things up: Only do this if you hate your company and everyone working there.
Who's "they"?
If it's Urologists, like, those are the experts. If it's someone on Twitter, they don't matter. If it's women as a whole… oh, boy. Dude. If it's "the jews", OH. BOY. DUDE. HOW EVEN?
Only data that is not stored cannot fall victim to attackers. It does not matter whether it is a 'nigerian prince', Microsoft or some agency. Even if you completly trust whatever entity with your data right now, they may become problematic in the future.
This is why a low profile is a crucial component of OPsec.
Recall is objectively stupid, even if Microsoft only had their users best interest in mind. And they don't.