To throw my own (admittedly niche) Catalina anecdote into the mix: In El Capitan, Apple introduced something called System Integrity Protection (SIP). This is

To throw my own (admittedly niche) Catalina anecdote into the mix: In El Capitan, Apple introduced something called System Integrity Protection (SIP). This is a security layer that prevents you from doing certain things, like modifying system directories, even as root. The idea is that malicious software could gain root permissions and still be unable to do the most egregious stuff. Okay, fine. You can turn it off by booting into recovery mode and running a command. I'd done this in the past because most of my company runs Linux desktops and some of our core software and scripts explicitly refer to network directories normally mounted in the root dir (yes, really). So since macOS mounts remote volumes under /Volumes, I had symlinks pointing from /foo to /Volumes/Foo. Updating to Catalina removed all of these symlinks. Okay, sure, it's a system directory and they probably just overwrote it in the process. So I went back and turned off SIP, but afterward I still couldn't "sudo ln". What gives? An extensive Google search turned up the fact that in Catalina, system directories are now mounted as a separate, read-only volume, at startup. So even with both admin permissions and SIP turned off, there is zero way whatsoever to write to them. An even more extensive Google search revealed someone who'd figured out you can re-mount the root dir after boot (and after turning off SIP, of course) as a writable drive, at which point I was able to finally re-create my symlinks. This took me about an hour to sort out. If there hadn't been a workaround on that random forum (which by the way feels like a loophole, as it only required root permissions), I would've been forced to stop using a Mac altogether.