Avoiding having SIP permanently disabled to permit kernel extension I'm looking to work around the lack of support for a wireless adapter in Big Sur by using https://github.com/chris1111/Wireless-USB-Big-Sur-Adapter/. Unfortunately it requires SIP to be disabled not just during installation, but permanently. I'm trying to understand why that is, and whether there might be alternatives?
For instance, HoRDNS which faced similar problems you only need to temporarily disable it (https://github.com/jwise/HoRNDIS/issues/132)
Does anyone have any suggestions? My understanding of how all the kext stuff works is a little limited.
You can selectively enable parts of System Integrity Protection.
For example, you can enable all of SIP except kernel extension protection with
csrutil enable --without kext

Some other options to try listed in https://developer.apple.com/forums/thread/17452, but the kext option sounds the most promising.