The problem with SIP though is that this higher than root access is not accessible to the user, only to Apple. You can turn it off completely but there is no wa

The problem with SIP though is that this higher than root access is not accessible to the user, only to Apple. You can turn it off completely but there is no way to make your own changes. It's trust Apple 100% or nothing. In contrast, alternative OSes implementations of mandatory access control do have a role that can be accessed by the user.