Where does it say that? As per rfc7489 4.2:

A message satisfies the DMARC checks if at least one of the supported authentication mechanisms:

   1.  produces a "pass" result

Personally I did not test yet what a DMARC result 1 fully failing check produces. I can say however that only 1 successful identifier-alignment criteria (and the other credential being valid but not aligned) is enough for an overall pass.

Of course the receiving mailserver is free to enforce a strict DKIM&SPF requirement aside the DMARC check/spec. If your question is why that would be necessary, I'd love to hear the reason aswell