It is implicitly so. As far as I know you need to reverse engineer the whole process and disguise the kernel you want to run as a macOS Mach kernel. They keep a finger on the trigger by having an encrypted Secure Boot system, too. Not to mention how much the system is locked in (soldered SSD necessary for booting, Internet connection mandatory for starting the system the first time, etc..)

One or two steps short of the hermetic lockdown of iOS devices.