The point of PAC is that you can’t create an arbitrary return pointer - it’s not based on ahead of time knowledge of what they fill CFG state is. The return address is signed as a byproduct of making the call in the first place, so to return to a different location you need to be able to rop through a pointer with a forged signature.
That doesn't invalidate the concept of pointer authentication as a whole, but does reduce the number of situations in which you should consider to apply it. If you have a large codebase 'bolting it on' will make pointer authentication much less effective. And when you're starting a new process, then why not start it in a language that offers stronger memory safety for a start, such as Rust?