ARC is more like a chain of custody than a security feature, unless you are very strict about it (which can cause breakage at scale).

Plus ARC isn't deployed everywhere yet. Large providers tend to do it, but sometimes older established email servers (like in academic institutions) may not be on the cutting edge due to smaller budgets and different use cases.