This is where I disagree. In my opinion it might not be that hard but the maintenance is really not zero as you just described how you need a reputable IP as a prerequisite and constant monitoring of block lists.
Just having DKIM, SPF and DMARC really was not enough last time I checked for getting delivered to let's say outlook.
If you're a domain that only receives occasional messages, and you end up on Spamhaus and co, you're gonna have a problem. It seems that reputation at small scale is viral. You need actively good reputation and response time. But, honestly, it seemed that it didn't take more than about 3 months per domain I administered until they were just accepted by the net as valid, good actors.
It would be annoying if entire US/European/Asian ISP IP ranges were immediately blocked. We should have moved on from that for many reasons unrelated to email.
You also want some spam filtering, which, these days, is apparently much more powerful with local LLMs. I used to just use various bayesian classification tools, but I've heard that the current state of affairs is better. Having said that, when you've trained the tool, it does a pretty good job.
It's not "plug-and-play", but it's not that hard. Once you've got it up and running the maintenance load goes to almost zero.