(Also, some things were just wrong. Like, “the transmission of system information immediately after connection establishment” is a clear sign of malware? No, every single telemetry / error reporting tool does that.)
Entitlements aren't stored in Info.plist. They're embedded in a binary's code signature.
It demonstrates code injection via Mach APIs starting with `task_for_pid` when `task_for_pid` is only usable by root or by a process signed with specific entitlements.
VeraCrypt does use the hardened runtime and so the `DYLD_INSERT_LIBRARIES` example cannot work with it.
It gives an example of using `emond` for persistence, but that was removed from macOS several releases ago.