My understanding is that if boot security cannot be established, it's impossible to assert runtime security either. Otherwise, a compromised code in the boot process can also alter how SIP behaves, essentially invalidating its security function.