As you can see in the screenshot, I’m running my M1 MacBook in “Reduced Security” mode in order to use applications (e.g. Boxcryptor) that requires a 3rd party kernel extension (e.g. macFUSE). Under normal circumstances, I wouldn’t want to run a device with ‘reduced security’ but what’s the reduced security here? It seems like Apple’s definition of ‘reduced security’ is simply preventing me the owner from using a past Apple signed version of MacOS or preventing me the owner from simply having the option to approve a 3rd party kernel party extension in security preferences. By the way, to get to this security menu, one has to undertake a byzantine 6 step startup option which includes entering your user account password twice.
View attachment 1704249
You pretty much hit the nail on the head. For T2 Intel Macs, this mattered more as there are a TON of malicious x86 based operating systems that you could boot on an Intel Mac or x86 PC. So, ensuring that you're using a signed version of macOS or Windows meant that you were using an OS that was trusted to be valid and not tampered with. For Apple Silicon, I don't see much of a point. There's Asahi Linux that is trying to become a bootable alternative, but past that, the only OS that can natively boot on an Apple Silicon Mac is macOS.
As for kernel extensions and remote management of kernel extensions, given Apple's direction towards deprecating them, this makes sense and is probably the only set of security settings that REALLY make a difference on an Apple Silicon Mac. But even then, I can't imagine that there even are that many third party Apple Silicon kernel extensions out there (or anyone with any logical reason to craft one, whether malicious or not).
