Only if they’re used. There are no DMARC records in place for harvard.edu or subdomains, which is kinda shocking.
The lack of DMARC records, even if it could facilitate spoofing, won’t magically make reply emails addressed at a valid @harvard.edu address land in a spoofer’s inbox. A different Reply-To address is possible but then you can’t claim a lack of warning signal. There’s something else going on.