Although according to the update in KB5000871, an additional series of security updates are being produced by Microsoft for older CUs which include Exchange 2016 CU17, these update packages are only a temporary measure and are available only through the Microsoft Download Center (not on Microsoft Update). Therefore, KB5000871 won't be installed during the Windows Update.
That being said, for your current scenario, it's suggested to follow the recommended path below, that is, installing the latest supported CU (CU19) and then apply the applicable SUs:
Reference: March 2021 Exchange Server Security Updates for older Cumulative Updates of Exchange Server.
Furthermore, the official blog below contains information and resources that can help you plan your updates, troubleshoot problems, and help you with mitigations, investigation, and remediation of the vulnerabilities, hopefully you can find it helpful:
Released: March 2021 Exchange Server Security Updates
If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.