Lack of participation in DMARC by default certainly isn't helping. Not sending those reports makes all those exchange servers invisible during your DMARC deploy

Lack of participation in DMARC by default certainly isn't helping. Not sending those reports makes all those exchange servers invisible during your DMARC deployment process, which makes deploying DMARC harder if you're on exchange, which makes it easier for people to impersonate your domain. Microsoft has needed to fix this for years.