Here lies the problem. Why pick <c> / <ç>, and not <s> ?
They must have had some reason.
According to the dictionary of the RAE, Spanish sultán is derived from Turkish. It's of course possible that it reached Spanish via Arabic (but why then does the dictionary not say that), but it's also possible that this word was borrowed at a later period of history than the others. Maybe it's post-medieval...As regards the treatment of the two Arabic /s/s in Spanish borrowings, I have detected three cases.
1) Arab. ? (emphatic /s/) > Medieval Span. <ç> [ts] > Modern Span. <z> [?].
e.g. al-qaSr ????? “the castle” > Alcaçar > Alcázar
2) Arab. ? (non-emphatic /s/) > Span. <s>
e.g. sulTaan ????? “sultan” > sultán
3) Arab. ? (non-emphatic /s/) > Medieval Span. <ç> [ts] > Modern Span. <z> [?].
e.g. Tassa(t) ??? “teacup” > taza
siid ???“lord, sir” > El Çid > El Cid
The problem is how to account for (3).
In short, I am not convinced that sultán is a valid counterexample to my statement.