Does FedRAMP have any teeth (penalties for misconfigurationbreaches/etc)?

If it's just a box-checking exercise, then this outcome isn't unexpected. Some of the box-checking will lead to better practices by vendors, but they won't go the extra mile into ensuring their policies are followed all the time.