What “should be done” is irrelevant - what matters is what “is done”. And plenty servers don’t enforce SPF, DKIM and DMARC. (In fact not even Google and Yahoo did it, before February of this year.)

And, when you know that your product has a flaw caused by a third party not doing the right thing, and you can reasonably solve it through your craft, not solving it is being irresponsible. Doubly true if it the flaw is related to security, as in this case.

Let us learn with Nanni: when Ea-nāṣir sold him shitty copper, instead of producing shitty armour, weapons and tools that might endanger Nanni’s customers, Nanni complained with Ea-nāṣir. Nanni is responsible, Zendesk isn’t. [Sorry, I couldn’t resist.]