That doesn't seem to be a huge issue. If someone actually does this for income, would they avoid disabling sip for 2x performance gain for example?
Sounds like you've you done a bit of digging around, you're efforts are appreciated. I found and a github of people
sharing what they know, here's a guy live streaming hacking it and building a tinygrad https://youtu.be/mwmke957ki4
You can't even poke the ANE hardware directly from a regular process. The interface for accessing the neural engine is not hardened (you can easily crash the machine from it).
So the matter is essentially moot in practice as you'd need your users to run with SIP off...