What do you mean "no one has to follow an existing ARM CPU definition"? That is quite literally what an ISA is and why different ARM CPUs (of the same revision) are compatible with each other. If you had different vendors implementing different specifications in an incompatible way, then binaries that run on one vendor's processor would be incompatible with another's and that processor would no longer be considered an ARM CPU.

ARM (the company) licenses both ISAs and reference implementations of their CPU cores to each licensee to implement how they wish. Some vendors use that reference implementation and make minimal changes to it, others scrap it and build their own based on the ISA that was provided to them, but regardless, they are still binary compatible with each other. That means that I can take one Android APK compiled for a single CPU architecture and run it on multiple devices that use the same ISA but have CPUs made by different vendors. That is, of course, assuming Android has been ported to both devices. That is why I can run, say an aarch64 build of NewPipe on my phone, on a modded Nintendo Switch, and on a Mac running Asahi Linux with Waydroid.

Intel and AMD both implement the 64 bit AMD64 and the 32 bit x86 ISA due to a weird cross licensing deal from the failure of the Itanium architecture and the success of AMD's backwards compatible implementatiom of a 64 bit version of x86, for instance, but they do not share implementation designs with each other. Regardless, they both can run the same binaries.

RISC-V is a royalty-free ISA that is strictly defined by RISC-V International with extensions being approved over time. Many different companies all over the globe are implementing wildly different RISC-V designs, but since they all use the same strictly defined ISA (assuming the same bitness and ignoring differences in operating systems/lack of OSs, bootloaders, etc), they can all run the same binaries. If you try running a RISC-V version of some Debian package on a SiFive CPU, that exact same precompiled binary package will run on a StarFive CPU. There are even RISC-V cores that have proprietary extensions, but since they also implement the base ISA, any code compiled with support for the base ISA will run. Now on the other hand, code compiled that require those proprietary extensions will only run on CPUs that implement those proprietary extensions. This does not mean that RISC-V is not strictly defined, but due to the way the permissive licensing of the ISA works, modifications without contributions upstream are allowed.