OK ... so w MacOS there is a user w more power than root? There has to be some entity that can ultimately install a new kernel and subsystem.

It’s more that there is far more protecting the system (and also e.g. data from different apps against each other, or things like access to your screen content), than the current user. Some of this is because we’re in a world where Macs and iPhones are far more likely to be single user machines than the UNIX machines of lore. See the PDF in my other answer.

There could be code in the system that directs IO and only allows write requests to parts of the OS if they include a signature from Apple.

I'm not sure if "a user with more power than root" would be the right way to describe that. The code would have a permission that "root" doesn't, but I wouldn't call the code "a user". It's a Unix idea that "a specific set of permissions" and "a user" are synonyms. Systems can exist where some permissions aren't represented as users.

No, there is no more powerful user, it’s just that the root user no longer has arbitrary control - it means that if an attacker compromises a root owned process the attacker can’t turn around and control the kernel.

The kernel has a number of things it can do: if you try to do a special thing it could force authentication itself - eg a “root”/admin user can still do the action, but a process with “root privileges” cannot, it can require the process attempting the action have correct entitlements, it can simply reject the operation entirely, etc. it can do all of the above: I recall there being some operations that can only be performed by specific apps, with specific entitlements, as special users, with immediate authentication (startup items and the like)

root is essentially a POSIX concept, and from a POSIX perspective this is still root, it’s just that the POSIX security model is by far not the only thing in play here.

When Apple introduced SIP, they marketed it as “Rootless”.

SIP is another system that exists besides POSIX and the root user. With SIP enabled, let me demonstrate:

    chris@chriscomp /usr/bin # sudo su root
    root@chriscomp /usr/bin # touch testo
    touch: testo: Operation not permitted