even with sip disabled, the System volume is still read only, and even if you remount it as rw, the System volume was signed, so any changes, even a single byte, will cause your mac to not boot unless you manually re-sign with a new snapshot.