STIGs apply to DoD systems administered by DoD staff or contractors. SCAP scans have similar scope. Commercial cloud is covered by CCSRGs. This is Microsoft's problem.
The system owner is responsible for security of systems they have deployed on Fedramp services. Microsoft is responsible for securing the service but they don't make sure every vm you spun up on Azure meets your own security baselines. Those vary not just between agency but even specific site. Expecting the vendor to do all of that is an impossible task.
The email is run as a service isn’t it?
Yes and know. The implication of it being an "unsecured email server" to me sounds like they spun up a VM for some reason instead of using Exchange online.