Indeed. It certainly raises some GDPR questions if it happened exactly like that:
Dear third party providers,
We are sharing all our staff's email addresses with you (in a file/via an API link) and would like you to contact them with an email where you communicate important information to them about a matter relating to discrimination law. We do not want to see the wording of this email before you send it.
Regards,
The Cabinet Office
Or.....
The third party provider created the email, passed it to the Cabinet Office who decided to then send it out to staff.
They need to decide whether they are accountable for a possible data protection law failure (first scenario), unless they can show why it is justiable to share this Personally Identifiable Information (PII) or if they are accountable for the content of the email that went out from them to their staff (second scenario). If they sent the email without checking what it said, they are still accountable for the content... It's simply an approval process failure, either due to lack of competence on the part of the approvers or human error on process.