/usr/local/bin is not under SIP, /usr/local is. Homebrew now changes the permissions and ownership of the directories inside of this to get around this (which is functionally the same thing, but I figured that I'd point this out to you before someone else did since your points are otherwise valid).