It's not dependant on the logged-in user, keystone is a background agent (daemon) that handles Google's updates. The expected scenario is that the browser is i

It's not dependant on the logged-in user, keystone is a background agent (daemon) that handles Google's updates. The expected scenario is that the browser is installed by an administrator (a sudoer), and the keystone agent is installed the same. The background agent runs as an elevated process specifically to remove the dependency on the logged-in user .. but with the side-effect that you're now trusting Google not to remove /var. Because, yaknow, we generally assume Google aren't that clueless. Then we have a layer below that, "System Integrity Protection" (further enhanced by read-only-root in 10.15) which stops processes removing such vital parts of the OS, even if they are root. Which is where the Avid red herring came from. If you need to install unsigned kernel extensions, you need to disable SIP. And it turns out third-party video drivers are popular with the video editing crowd - so they had a much higher prevalence of users running without SIP.