> SIP protects "/" but not "/Users" (macOS' $HOME base).

> that's why Muse could get it even with SIP.

Both of these assumptions are mistaken.