SIP is wonderful. I no longer have to completely repave machines after my family install crapware because I know it can't mess with the base system.

But for those of us who need that access we can disable it, with a bit of a dance to make it hard for people who _don't_ need it.