What does SIP stand for? What does it do? Why do certain people need to disable it? That might educate me as to why my comment on “tinkering” is incorrect.
System Integrity Protection. Basically, the system is now in a separate APFS volume with readonly privileges for all users, including root, so even if some malware gained root privileges it wouldn't be able to launch an attack that required modifying system files (i.e. a keylogger probably would need this kind of access to the system volume).
By disabling SIP, you remove that protection (so you fall back to the way things were before OS X 10.11). Malware still needs to escalate privileges to gain write access to sytem files, but there's no additional protection after that.
However not everything that modifies system files is malware. There are some genuine applications. Apple doesn't list a lot of them, but notes that developing DriverKit applications may require disabling SIP. Some other things that require low-level access to the hardware usually also require this (WiFi sniffers, for example). And cybersecurity engineers also may find it useful to turn it off sometimes.
Obviously, not a lot of people need to turn if off. It's a great security feature, it should
absolutely be enabled unless you have a very good reason to disable it. But csrutil (the utility to disable SIP) it's still a well documented feature that Apple supports and having it disable other features in the OS when turned off should be avoided or (at least) documented.
