TCC throws up vista-style warning prompts everywhere, so to bypass them he opened up remote desktop so he could manually dismiss them, which then got exploited via a recent pre-auth bug in ARD.

If the TCC prompts could be dismissable some other way (e.g. via CLI with root permission) presumably he wouldn't have resorted to such measures. I sort of see the point, the lesson from Vista is that if you put up annoying obstacles people are going to the easiest workaround, bulldozing over them rather than putting up with them. People will end up disabling SIP or poking more hole if they don't have an easy way to bypass TCC stuff.