That's all it takes.
Understood. But that is a very big "all".
It would largely defeat the "group" concept, turning Groups.io into a mere mail reflector.
> The only concern that comes to mind is that this could be another step down
Which messages are you referring to?
A DMARC record for groups.io will definitely apply to messages that have had their From rewritten into the groups.io domain. It wouldn't impact those that have not been rewritten (such as yours and mine), but that was the point I was making.