T1 was just for Touch ID. T2 did change a lot, but SIP is still as easy to disable as it was before T2. When Apple Silicon came out with a completely different boot process, they still allowed disabling SIP (and added the ability to do it per OS instead of at a global level), and despite the secure boot, they give you the option to turn that off and boot whatever you want (see Asahi Linux). I doubt they would have put the engineering effort into that if their plan was to lock the Mac down.