Can these domains be spoofed? We checked SPF and DMARC of 102 well-known domains, and only half of the banks reject forged mail

SPF, DMARC and MTA-STS of 102 well-known domains: 59 reject forged mail, 21 only monitor with p=none, 6 have no DMARC. Banks, Germany and Italy compared.