[ArchOversight]

The root (/) is a disk image/APFS snapshot. Apple didn't delete anything... their update replaced that image that you are booting from, which is supposed to be read-only.

  /dev/disk3s3s1 on / (apfs, sealed, local, read-only, journaled)
  devfs on /dev (devfs, local, nobrowse)
  /dev/disk3s6 on /System/Volumes/VM (apfs, local, noexec, journaled, noatime, nobrowse)
  /dev/disk3s4 on /System/Volumes/Preboot (apfs, local, journaled, nobrowse)
  /dev/disk3s2 on /System/Volumes/Update (apfs, local, journaled, nobrowse)
  /dev/disk1s2 on /System/Volumes/xarts (apfs, local, noexec, journaled, noatime, nobrowse)
  /dev/disk1s1 on /System/Volumes/iSCPreboot (apfs, local, journaled, nobrowse)
  /dev/disk1s3 on /System/Volumes/Hardware (apfs, local, journaled, nobrowse)
  /dev/disk3s1 on /System/Volumes/Data (apfs, local, journaled, nobrowse, protect, root data)
  map auto_home on /System/Volumes/Data/home (autofs, automounted, nobrowse)

Stuff that is located on /System/Volumes/Data is on a non-readonly disk and will not be touched by any updates. You can see folders in /System/Volumes/Data that are also in / and there is some magic overlay that maps certain folders to /System/Volumes/Data automatically. So that files in /usr/local/ are actually stored in /System/Volumes/Data/usr/local.

[prirun]

Thanks very much! I had no idea about this, but doing a find command as root did indeed find my backup. It was at:

/System/Volumes/Data/Users/Shared/Previously Relocated Items/Security/hbbackup

I don't know how people are supposed to know this. Plus it is taking up 50GB of space!

[Aloisius]

IIRC, it should create an alias on your Desktop called Relocated Items or something similar to them after the upgrade that pointed at it.

[prirun]

Thanks! I never look at my Desktop and so never noticed it. I deleted the original, moved backup today, and there is nothing on my Desktop about Relocated Items. That could be because I removed it, like an Apple smart link thing, or maybe it was never there - dunno.

IMO, if they're going to do something this drastic, they should at least have a one-time large pop-up box after the upgrade explaining that they moved things that were formerly in root, and wait for a user to confirm that they read the notice.

[ArchOversight]

That would be unnecessary for almost every single last macOS user, you are an outlier.

If you go against the grain or the way the OS is built and explicitly disable SIP and do things the OS would normally not allow, you are expected to understand the OS enough to know where things have disappeared to when they disappear.

I don't think Apple should protect the very small minority from themselves.