That is a common DMARC configuration but not the only one. The failure tolerance is configurable.
How do you configure DMARC to require both of DKIM and SPF?
The RFC says:
https://datatracker.ietf.org/doc/html/rfc7489#section-4.2
A message satisfies the DMARC checks if at least one of the supported
authentication mechanisms:
1. produces a "pass" result, and
2. produces that result based on an identifier that is in alignment,
as defined in Section 3.