Microsoft will end support for Exchange Server 2016 on October 14, 2025

Yes, after the End of Support date, in principle no more patches will be made for the product, including security patches.

Sometimes, such as a major leak risk or a highly publicized leak, an exception is sometimes made and one is still released. But these are the exceptions that prove the rule.

Microsoft has it for some products Extended security update (ESU), but mostly related to OSes (Windows) and SQL Server, Exchange does not seem to be among them.

And you have to pay for that ESU, and then some. And that is also finished, because it continues for a maximum of 3 years, and then it also stops.