Was it just a gaffe when Federighi mentioned you couldn't install alternative operating systems in his recent Daring Fireball interview, then? I admit I could have misunderstood him, but it seemed like that was what he was saying.
When SIP (rootless v1) was introduced, macOS came with a way to disable it, for the sake of kernel developers. When APFS was introduced by default, macOS retained two workarounds for kernel developers: both the ability to boot from alternate APFS volumes within the APFS container; and also the ability to install to/boot from HFS+. And when the system volume became truly read-only in Catalina (rootless v2)—that's right, even that restriction could be overridden via csrutil, specifically to facilitate kernel development.
Apple is never going to lock themselves out of booting custom OSes that are almost, but not quite, macOS; because that's how new macOS gets made.
And, of course, as long as you can boot something that's not literally macOS; then that same mechanism can always be abused to boot something that is much less macOS, or in fact not macOS at all (but may still seem to be macOS, from the bootloader's perspective.)
So actually, going forward they only need to make it easier for their own kernel teams, not third parties.
Given how they keep stressing the security and kernel stability during those sessions.
They are turning macOS into a proper micro-kernel, by changing the engines while keeping the plane flying.