“p=none is meant to be a temporary monitoring phase before you move to enforcement, typically a few weeks. Fourteen years after the standard shipped, for the largest single group of domains in our data, it looks like the permanent state.”
Two thirds of domains either have no DMARC record or one that does nothing. The reason is not cost. Enforcing means auditing every service that sends mail as you, and the reports hand you raw IP addresses with no owner attached. So administrators park on p=none forever and their domains stay spoofable. Fourteen years of a free fix nobody finishes.