Shrootless: Microsoft found a way to evade Apple's SIP macOS filesystem protection – The Register

An Apple software installation daemon called system_installd allowed its child processes to bypass SIP's normal restrictions on filesystem access.
View full source