The Arabic site had no address
Language was resolved from a cookie, so every page lived at one URL. Googlebot sends no cookies — so every crawl saw English, and there was no second URL to point an hreflang tag at. The Arabic site was, to a search engine, not there.