This is true, although if I look at my old company - they've migrated to Exchange Online and run onprem Exchange servers to support the hybrid environment. But

This is true, although if I look at my old company - they've migrated to Exchange Online and run onprem Exchange servers to support the hybrid environment. But they don't need to publish those servers to the Internet. Many of these orgs should have learned this after [CVE-2020-0688](https://www.thezdi.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys https://www.thezdi.com/blog/2020/2/24/cve-2020-0688-remote-c...) If it's a hybrid environment, it doesn't need to be exposed. That doesn't solve MS problem of coming up with a better solution though