In an Exch 2016/EXO hybrid deployment, should a telnet message test on prem be considered internal

Did you want to set the SMTP relay message as internal? You could set the receive connector you just created as “Externally Secure”.

The receive connector auth and permissions will now look like this:

AuthMechanism : Tls, ExternalAuthoritative

PermissionGroups : AnonymousUsers, ExchangeServers

What you see in the headers of a received message:

X-MS-Exchange-Organization-AuthAs: Internal

X-MS-Exchange-Organization-AuthMechanism: 10

In the end, all messages that pass through this connector ( and eventually through the hybrid connector to Office 365) will be considered authenticated.