DMARC is not hard.

"Reputation scores" and blacklists / greylists started in late 1990s / early 2000s as multiple grassroots efforts when spam started to overwhelm systems. Gmail did not exist, outlook.com did not exist, it was easy and expected to run your own SMTP (which I did). And it was very unpleasant.

DMARC appeared 10 if not 15 years ago. There's no reason for a sane MTA configuration not to have it.