But you disable SIP while booted in recover mode. Somehow Apple needs to do this anytime the system is updated.