&gt; Some parts of the filesystem become off limits, even as root. But installers have access!<p>Point of clarification: only Apple-signed installers can modify system paths. (c.f. <a href="https:&#x2F;&#x2F;support.apple.com&#x2F;en-us&#x2F;HT204899" rel="nofollow">https:&#x2F;&#x2F;support.apple.com&#x2F;en-us&#x2F;HT204899</a>) All other installers are subject to SIP restrictions.<p>And Apple only added a few simple steps for people eager to tinker: reboot and disable SIP. Or reboot into the installer for the other OS with which you prefer to tinker. Or create a VM with an experimental OS. Frankly, most of those steps existed before SIP.<p>Most users shouldn&#x27;t care or notice, and will benefit from increased protection. People who want to tinker will (and can and should!) tinker.