Avoiding having SIP permanently disabled to permit kernel extension
Solution 1:
You can selectively enable parts of System Integrity Protection.
For example, you can enable all of SIP except kernel extension protection with
csrutil enable --without kext
Some other options to try listed in https://developer.apple.com/forums/thread/17452, but the kext option sounds the most promising.