You create and run one fixup script as root to modify /etc/ssh/sshd_config. That is root writable and not protected by SIP. It is a tiny hassle, but really no

You create and run one fixup script as root to modify /etc/ssh/sshd_config. That is root writable and not protected by SIP. It is a tiny hassle, but really no big deal. The fixup script can handle any of these cases, assuming they are in config files that are writable.