Blacklists catch far more spam than bayes, are far easier to administer and far less resource intensive. Personally, I try to deploy both, with blacklists first in line, then bayes to catch some stuff that the blacklists miss.

"Sender authentication" is a vague term. If you mean verification of the sender address via various DNS lookups, then yes, that's quite useful, but still nowhere near as useful as blacklists.

This is how I see people setting up their spam filters in the industry. It might not be idealistic, but it is effective and wide spread.

SPF and DKIM are good for preventing some false positives. They're not good for stopping spam.

I would bet that currently, well over 90% of spam that is rejected, is rejected because of blacklist lookups.