I think you have that backwards. You, as the person with physical access, is in full control as SIP can be controlled from recovery mode. Processes running as r

I think you have that backwards. You, as the person with physical access, is in full control as SIP can be controlled from recovery mode. Processes running as root are no longer trusted to have full access to the system. This is definitely a step in the right direction.