But there is a chain: 1) the mail provider only allows outgoing mail with a particular Return-Path / Envelope Sender / From header if it has done authorisation

But there is a chain: 1) the mail provider only allows outgoing mail with a particular Return-Path / Envelope Sender / From header if it has done authorisation checks to ensure the sender is allowed to use that address, 2) the mail provider DKIM-signs their outgoing mail. The combination of 1 and 2 work together. Yes, the mail provider could impersonate you, or could fail to do (1) correctly, but that is a different threat model to one where having no verification at all is okay.