Have I misunderstood DMARC this whole time?

Years ago and read and understand the concepts of spf, dkim, and dmarc. over the past few months, i've been setting up spf/dkim for the allowed senders we know about. But I read something recently that made me thing: DMARC is based on the envelope FROM address...

So if a bad actor was only header FROM spoofing, assuming the envelope from is legit and configured, that emails could come in as passing DMARC. When googling multiple sources referenced that SPF/DKIM …

actor address bad concepts cybersecurity dkim dmarc spf understand