[ryannielsen]

> Some parts of the filesystem become off limits, even as root. But installers have access!

Point of clarification: only Apple-signed installers can modify system paths. (c.f. https://support.apple.com/en-us/HT204899) All other installers are subject to SIP restrictions.

And Apple only added a few simple steps for people eager to tinker: reboot and disable SIP. Or reboot into the installer for the other OS with which you prefer to tinker. Or create a VM with an experimental OS. Frankly, most of those steps existed before SIP.

Most users shouldn't care or notice, and will benefit from increased protection. People who want to tinker will (and can and should!) tinker.