YMMV, but, in my experience the biggest difference between these platforms and "real world" is the amount of data available (generally). At big companies, if you were to run a red team exercise or pen test, most of the probing and data gathering you do is on confluence, open git repos, and other places of documentation. Not running nmap or sitting in the middle of two services and inspecting packets. That's not to say that more advanced testers don't employ those methods, but the reality is, the most effective way is to expose yourself to the data available in front of you.
Disclosure: I run Vulnerability Management and Assessments globally for one of the largest companies in the world
Disclosure: I run Vulnerability Management and Assessments globally for one of the largest companies in the world