[sgjohnson]

First you need to trick Apple into signing that kext (which is getting more difficult by the day even for legitimate uses), or get the user to disable SIP first.

[throwaway290]

Didn't many tools require disabling SIP, like Homebrew? Is this no longer true?

[sgjohnson]

This hasn't been true for at least 2 major macOS releases.

But yes, there was a time when editing even /etc/sudoers required disabling SIP. That time is long gone.