I received a data breach notice from a local business as required under GDPR and it had failing SPF and DKIM as if it was intended to go straight to spam. Hard

I received a data breach notice from a local business as required under GDPR and it had failing SPF and DKIM as if it was intended to go straight to spam. Hard to say if it was intentional or incompetence, but it seemed like a good way to fulfill the requirements of the law without the reputation hit!