FWIW, running code in the kernel is not "real root permissions", it's kernel-mode privledges, which are much different and arguably much more dangerous. For my

FWIW, running code in the kernel is not "real root permissions", it's kernel-mode privledges, which are much different and arguably much more dangerous. For my money, running custom kernel-mode code is not a concern. Apple is infatuated with remote device attestation for some reason though, so preventing OS modification is paramount for them right now. It's a limitation, but one that's hard to get mad about when Macbooks have a mostly-open bootloader.