SPF/DKIM are not intended to prevent people from sending spam.

They are intended to let a domain owner tell other email providers what servers have the right to send email from that domain (and sign email).

I can send email all day from joboffers@google.com. But most email providers will check SPF and see that my VPS IP is not authorized by google.com to send email, and it will go to spam.

Those standards wouldn't keep me from registering example.com, setting up SPF correctly, and then spamming. There are other techniques to filter out that kind of behavior.

I might be reading into this a little, but you seem to be arguing that "Spam is a reasonably solved problem at my scale, therefore spam is a reasonably solved problem at global scale", and those are very different things. One of the key differences is: a small domain like yours is multiple orders of magnitude less attractive of a target, vs. Gmail, and as a result Gmail's filters are subject to constant, high-volume adversarial attacks, and you are not.

SPF and DKIM are pretty explicit in their RFCs that passing authentication isn't a sign the mail is legitimate. The presence of passing auth in a message does change how filters should handle it, but for most larger-scale production filtering systems (not spamassassin) that mostly ends up as "change the weight of certain reputation identifiers in the spam filtering inputs", more or less.