In that case, SMTP assumes an "implicit MX" and attempts to deliver the mail to the IP address (if any) of the bare domain name.
Of the 119 million domains without an MX record, 76 million (64%) do have an IP address, meaning they could at least theoretically receive mail.
Reversing those bare domain IPs again, we can guess what services handle default domain parking:
28.8 million are under amazonaws.com., awsglobalaccelerator.com., and cloudfront.net.; 18 million under Google's 1e100.net. and googleusercontent.com.