The ARM,6502 and M68000 are not worlds apart in the number of instructions they use. It's got to do with the complexity of the instructions and number of addressing modes.
The 6502 and M68000 have lots of addressing modes. The 68000 also has quite complex (almost high level) instruction types (so is definately a CISC). The ARM has fewer addressing modes, most commands are relatively simple (so would IMHO qualify as a RISC), it does (however) have a few instructions that are a bit more complex than a RISC should have - things like multiple store/load (STM/LDM). As most of its instructions fall into the RISC camp - I'd suggest (tentatively) its a RISC, but not a typical one