Thanks both MarcoLFrancisco and Mirela_Buru . The 2010 servers run 2008 R2 in this case, but I do believe TLS 1.2 has been enabled following the pre 2012 R2 guidance. Enabling TLS 1.2 a while back was the resolution step for making F/B lookups work from cloud to on-prem.2010mbx.
I can't remember if 2010>2016 lookups work so will check that too. I do know 2016>2010 lookups work. Main / only direction I know never works for neither Outlook nor OWA is 2010>EXO.
Regarding HCW and enabling OAuth vs not, I see the IOC and enabled evoSTS AuthServer so assumed it means enabled. Possibly another way to verify?
Thanks again I will review these things and share back if we get it going