Does FedRAMP have any teeth (penalties for misconfigurationbreaches/etc)?

If it's just a box-checking exercise, then this outcome isn't unexpected. Some of the box-checking will lead to better practices by vendors, but they won't go the extra mile into ensuring their policies are followed all the time.

The thing is, it always was. It is more about compliance with procedures than any real security.

“The cloud email server, hosted on Microsoft’s cloud for government customers, was accessible from the internet without a password, likely due to a misconfiguration.”

Well, they applied the last security standards. Didn't they ?