How to prevent even root users from uninstalling or tampering the application on macOS The aim is to prevent even root users from uninstalling our app on their mac.
Apparently, many security applications have this sort of functionality wherein a user(even with root privilege) can not uninstall or tamper with the agent on their machine.
I tried tampering/deleting an antivirus app on Catalina but I failed and noticed a few interesting things:

It has a kernel extension. But I can not remove the kernel extension(as root).
#kextunload /Library/Extensions/xxx.kext
(kernel) Kext com.xxx.kext did not stop (return code 0x5).
(kernel) Kext com.xxx.kext can't unload - module stop returned 0xdc008017.
Failed to unload com.xxx.kext - (libkern/kext) kext (kmod) start/stop routine failed.



The application is installed in /Library directory rather than the usual /Applications directory.
drwxr-xr-x    7 root  wheel   224 Oct 28 14:40 xxxx



The folder does not have any extended attributes. I can not delete this folder or any of its subfolders and getting permission denied error even as root.

The app has a bunch of launchdaemons but I can not remove them (again tried as root)
#launchctl remove com.xxx.xxx. 
 Not privileged to remove service.


Tried killing the processes, again operation not permitted.

The app comes with an uninstaller which can somehow uninstall the app, but it needs a special password (separate from system password) to be entered to work


Many of Apple's own apps and services have this sort of behavior but they come with the system and are backed up by System Integrity Protection.

How can a third-party app achieve this sort of behavior? This is not unique to this particular application but antivirus have similar sort of features. Any insight on how to achieve this..

Note: Ours is an enterprise app that will be installed on machines owned by the companies and managed by IT but end users will have root access on their machine.
The aim is to prevent even root users from uninstalling our app on their mac.

You as a 3rd party developer can't prevent the root user or users with root privileges from uninstalling apps that they, technically, can install themselves.  What one one admin can do another can (un)do.
The core OS is protected by SIP and if using Catalina or later, the system volume is read only.  This is implemented at the very base layer and not at the application layer where you operate.
IT, however, can manage permissions, rights, and roles through the use of MDM (Mobile Device Management) software.  Once a device is enrolled, IT will be able to create and enforce policies allowing/disallowing software use and installation.
This is for IT to manage, not the developer.