DMARC and SPF apply to the domain of the sender, not the recipient. If the SPF records for domain.tld only allow their network's IPs, it means that they won't

DMARC and SPF apply to the domain of the sender, not the recipient. If the SPF records for domain.tld only allow their network's IPs, it means that they won't accept mails FROM domain.tld that come from outside their network. Mails TO domain.tld should be accepted normally, no matter where they come from. It seems to me that the researcher was trying to communicate with those companies by sending them emails using a FROM address of the company. That is, he was sending mails with a forged FROM and SPF/DMARC stopped them as it was designed to do. Alternatively, maybe those companies were using some kind of email filtering service as "front MXes" that then tried to deliver to the company's own servers. In that case it would indeed be a mistake to not include the filtering service's forwarder's IPs in the SPF record, and they would indeed be unreachable from outside the company. In my experience this does happen from time to time, but it is very noticeable (your users will complain) and it gets fixed quickly. It's very stange to me that the researcher met this scenario multiple times...