In practice, that's not true. Major email providers will not respond any differently to ~all versus -all, despite what the RFCs state you should do.
Your configuration is trivially spoofable by setting Envelope Sender to something attacker controls (and thus it will pass SPF), while still placing your domain in the From header.