This question is subjective to the firm you are working for and the position you hold with the firm. This tool that is built into office can be used against you and provide target rich Intel to mass spammers and exploiteers.
For example your primary smtp gets leaked (somehow or another). This address gets hit with an automated spam cannon and returns a hit to attacker saying you are out office. The contents of auto reply is the real security issue- although all auto replies should be questioned. If the contents contain supervisor or other position redundancies then this data could be used to socially engineer a chain of command within the company. This can also be used to identify failures in employee redundancy. If your title is "malware intrusion analyst lead" then it could be assumed by attackers that the first and second tier incident responders are still actively watching for intrusion. Either way having a title can sway the attacker in a direction to act upon the return:
If it is believed you are the sole analyst then attacks seem welcome, if you are believed to be one of many but the lead then actionability may be degraded until you return.
If you include your supervisors details then this can be used to "leak" other higher value targets to the attacker.
I am a malware intrusion detection analyst and have never used the out of office functionality for this very reason. If you need to have comms external from exchange for emergency IR, I would suggest groupme or slack to provide a specific IR channel to only use in emergency contact scenarios.
Groupme provides a free API service that you can hit using their "bots" and a message will come to your phone.
Again this is subjective but true security professionals and supporting staff are always "in office" because the attacker can be "in office" anytime day or night.