How do system services modify protected directories with system integrity protection

Solution 1:

Time Machine backup protection isn't related to System Integrity Protection — SIP is for protecting system files. Instead, TMSafetyNet.kext is responsible for enforcing protection of backups and permitting Time Machine to make changes only.

You can edit backups using the ‘bypass’ CLI tool.

sudo /System/Library/Extensions/TMSafetyNet.kext/Contents/MacOS/bypass

Append the tool you want to use at the end as if you were using it normally, for example:

sudo …/bypass rm -rf /Volumes/Backups/Backups.backupdb/path/to/folder

This protection of backups predates the introduction of SIP, but I imagine the file protection feature of SIP was inspired by how the Time Machine backups protection works, so they have their similarities.