At some point Microsoft may enforce MFA on any Exchange workload, but for now, they are focusing on "management" workloads first.
You can of course, require MFA now for Microsoft 365 workloads with Conditional Access or in general if using security Defaults or per user MFA
You can also enforce MFA on admin portals: