More importantly they are on record in detail as completely denying this idea and asserting that they want people to be able to install whatever they want, and have access to all levels of the system. This is why you can switch things like SIP off.
This reduces the chance my 85 year old mum will accidentally download malware while still making it easy for me to install whatever I like on my machine or, for that matter, hers.
And they document how to switch off that protection if you’d like as well.
Want to put out some software and not pay the $99/year Developer Fee and still have a simple install process for your users? Good luck with that.
Brew install whatever you need.
Apple is doing a decent job here. Art Student gets a very easy to use computer with a safe app store.
Comp Science student can compile and install whatever they need.
Those are the pertinent words. Yes, folks like us have no issue going to Terminal.app and `brew install whatever`, but most "regular" users are going to baulk at that idea.