> (Now you can install kernel extensions)

This is wrong. There is no "now." Kernel extensions have been installable in macOS since 10.0, IIRC. The real "issue" here is that Apple has provided a mechanism for installing Kernel extensions into a protected bucket, but no way to uninstall them.

The fact that this whole thing isn't very well (or at all) documented even for developers (the ones writing the kernel extensions), seems like it's not the most ideal of situations.

Apple in general has always been a bit further in this direction, but it seems companies are increasingly leaning towards security over freedom, which is perhaps even more scary than insecurity itself. It's a hard position for a company to be in, but I suppose it comes from the fact that it seems receiving negative PR about being insecure is worse than PR about being unfree.

As a memorable saying goes: "The security people won't be satisified until everyone is living in prison."

When in the history of Mac OS X could you not install kexts?