This is why I am happy I no longer run an on-premise MS Exchange server. There are certainly some organizations that need to do so, but the vast majority do not. The risk far outweighs the possible benefits at this point - [https://www.bleepingcomputer.com/news/security/microsoft-outdated-exchange-servers-fail-to-auto-mitigate-security-bugs/](Outdated Exchange servers fail to auto-mitigate security bugs)