On: Apple has pushed a silent Mac update to remove hidden Zoom web server

[unsatchmo]

SIP cannot be disabled by anything running in the current boot session. Once the root volume is mounted, the SIP flags are set in the mountpoint. The root volume obviously cannot be unmounted while it is booted from.