I think the issue is that SIP is supposed to be like “beyond root”.

Because many installs (heck, going to a page with invalid cert in Safari!) ask for an admins password to install, which gives escalated privileges up to root.

So they added a level that requires higher than root access.

With this vulnerability, someone typing their password could allow beyond root privileges.

That is my simplified parsing of things.

Note - I didn’t read the article. I’m not in security. But I did live with Dan Kaminsky for close to 5 years. RIP :/