I don't know how it works for Macs, but on Fedora Silverblue you can definitely disable anything you consider to be an "invasive service". Also, if the immutable root comes with software you don't want, you can uninstall it by adding a layer to the root image.

I am no Mac expert, but it is surprisingly flexible contrary to their image as a walled garden. I wouldn’t be surprised if there were some magic incantation to turn off many of those “invasive services”.

For what it’s worth, Plasma’s file indexer is much more invasive in terms of running at the wrong times in my experience, so depending on what one mean, Linux also have similar services.

You do. Doesn’t matter what it’s meant for—the result is what’s important. And having to deactivate sip is a big trade off to improve privacy.

If it were privacy-first and read only, that would be another thing entirely. Defaults matter.