MTA-STS policy is not STSv1
The policy file was fetched but it is not a version STSv1 policy.
Why it matters
Senders ignore a policy they cannot parse, so TLS is not required.
What to do
Publish version: STSv1, a mode, and mx hosts, as RFC 8461 describes.
Reference
MTA-STS lets receiving domains require TLS for inbound email.