Phrased a little more harshly than I would've, but I agree. SIP keeps any random process running as the device owner from running amok and paving over the system. You have to jump through just enough hoops to disable it that a rogue process can't automatically do it against you.