How does ARM ensure e.g. that the foundry only provides the chips made with that mask to the company that supplied it? ARM can't necessarily rely on the contract between the foundry and the ARM design licensee to meet all of ARM's terms, and ensure that ARM has legal standing to enforce those terms.

Probably the only way they can be sure of that is to have a contractual relationship of their own with both parties.