I thought one of the features of having signed and verified boot partitions was that you could know exactly what's in it and can thus do cool things like binary

I thought one of the features of having signed and verified boot partitions was that you could know exactly what's in it and can thus do cool things like binary diff patching where it makes sense (which should be like >90% of all files in an update), and only ship complete binary images where absolutely necessary. Obviously this means you have to maintain 2 update tracks, one optimised flow for all the normies, and one for everyone who has disabled SIP. But the benefits are worth it when you consider all the electricity and bandwidth used by all the excess data you're no longer sending over the network. Combine this with APFS snapshotting and it should make for a resilient update schema which uses minimal amounts of data. Or am I completely wrong in my assumptions about binary diff patches?