yup, its really not that hard to break, but to break without the tool noticing is harder.

they usually work in kernel extensions or use https://developer.apple.com/documentation/endpointsecurity - which gives them pretty good coverage of all the processes running, and arguments etc