I suppose that is a concern, but I think those are cloud IPs they move around occasionally and wouldn't want to make every user update their TXT records.
So for this use case I am pretty sure they would always be DNS names if the admins are following Microsoft's instructions.
It looks like they have you set your txt record to spf.protection.outlook.com which resolves to a txt record with a bunch of their IPs. So if you really wanted to make sure there weren't installs with IPs in their list you can use that txt record to get Microsoft's IP ranges and search for those as well.
Yeah it is fairly trivial to check. I called it a SPF record but technically in DNS it is a TXT record. TXT records are just a generic record type used for many different uses.
Here are a few common DNS commands to lookup TXT records:
host -t TXT domainname
nslookup -type=TXT domainname
dig -t TXT domainname
For your barracudanetworks example here we get a few TXT records back but we can see spf.protection.outlook.com is in their list and therefore allowed to send of behalf of the barracudanetworks.com domain. All of the other entries are allowed to send of their behalf too so your email isn't guaranteed to go through Microsoft.
Judging by the Salesforce/Zendesk stuff they probably have ticketing/customer management systems, which means it might be possible to contact them without going through Microsoft's email servers. Notifications from those systems would probably be sending email directly to you instead of routing it through Office365.