Great breakdown, especially the challenge ladder. One addition for the "invisible signals" rung: IP-type feeds (VPN, proxy, Tor, known bot and C2 IPs) let you raise the challenge level for risky traffic without blocking all of an ASN, which also helps with the corporate proxy false positives you mentioned. For the link re-scanning step, a daily malicious domain list complements Safe Browsing.

Disclosure: I'm with WhoisFreaks, our Threat Intelligence Feed covers both sides (phishing/malware/spam domains plus VPN/proxy/Tor/bot/C2 IPs): whoisfreaks.com/products/threat-intelligence-feed