And that's why I use Citrix through an UTM Mac VM. That installer will create at least 3 background services running on root plus the app protection hooks (which happily run on a vm from which I can do pretty much it is meant to prevent through the host OS).