I read your post. I believe some of us (me at least) would appreciate a short heads-up if you have the time.
What does the rooted part mean for practical security and when did it change? Who if any, can snoop how and where?
The short version in your opinion would do.
You can read about rooting just by searching. What changed for me was that OCLP for Sonoma must now patch the most fundamental, secure components of the macOS operating system in order for Wi-Fi to work. There is a Wi-Fi framework that is injected by the OCLP post-install patcher (not just the kexts in OC EFI). It is my paranoia that raises the hair on my neck. Any time another party is injected into the data flow (thus a "man in the middle" - you can search for that), that is a problem for me and my spidey senses go up. People like me with Cisco and other certifications tend to go overboard when it comes to computer security. I've never been fired or dismissed from a job because I was too cautious about computer / network security. It's the nature of my work.
This is not because of some mistrust that I have in the Devs. It's the vulnerability that now exists because macOS has been tampered with at the most fundamental levels, thus "breaking the seal" of the secure OS. Even if my paranoia is out of ignorance and a lack of understanding of OCLP, I never make a computer security decision in favor of adoption unless I know with as much certainty as I can have.
-------------------------------------------------------------
Computer security is as much or more about what you don't know as what you do know. There are agencies (like NIST) who develop security standards (like FIPS). Software developers who can afford it and who need it for their customer base will hire a certified entity to perform the compliance testing required to obtain the security seal of approval. The security scan required to pass the test happens periodically and is required for maintenance of the certificate with each new software release. Don't expect anything like this type of certification with OCLP. In my experience, the times where we failed the security test were not because of things we did intentionally or knowingly, they were because of things we missed. They were because of bugs and mistakes.
As long as software can have bugs and mistakes and as long as it is developed by humans (or by AI that was developed by humans), the only way to have a degree of certainty in the secure nature of the software is to have it tested and certified with a seal of approval by a reputable organization. That is unlikely with OCLP.
EDIT: Each of us needs to make our own decision. I'm just saying that I won't be visiting my online banking website in Sonoma with OCLP post-install Wi-Fi patches.