If that's the user's situation, they should also be in a position to work out a better solution with whatever corporate/school IT is managing the firmware passw

If that's the user's situation, they should also be in a position to work out a better solution with whatever corporate/school IT is managing the firmware password. If you're frequently installing and uninstalling buggy kexts, you're pretty far out of the mainstream as a user. Let alone if you also have a firmware password, and it's managed by someone else. Yes, that's a scenario where SIP will be annoying, but it's also not the scenario you can base the security model around for a consumer OS.