I'm curious how SIP interacts with this. It's possible that the restore avoids touching anything protected by SIP. Though I hope not because then you wouldn't be able to snapshot before an OS upgrade and roll back if the OS upgrade is problematic.
Did the reinstall fix the issue? Since the reinstall preserves user data, is there any chance of malware re-inserting itself after the OS has been reinstalled?
Yes, a reinstall fixed it. And yes, persistent malware should be possible (unless you format your disk).
Or if the malware lives in the disk controller firmware in which case even formatting the disk won't help.
Is the "Firmware Restoration CD" sufficient to reset firmware to a known-good state?