My question was "Any examples of something that requires disabling SIP in cracked version and not original?", this (while certainly possibly relevant) is not an answer to that.

To me this is an answer. I think somehow you're not understanding what I am implying.

These guides I linked to are there because when the software is being installed, it asks for these guides to be applied, to make the apps work. The modifications added to the cracked applications by the crackers take them off Apple's trusted developers list. So the only way to get some of them to work is to disable SIP and GateKeeper. This move then makes the user's computer vulnerable to all malware, because most forget to turn them back on. They also often don't know about the importance of these security features in the first place.

I am not concerned for your safety - I trust you will be safe. I am scared for the user I described above.

I hope this make it clearer.

I won't bother replying to more of your messages until you can show that you've actually tried this all out on a VM, because otherwise we just won't be talking about the same thing.

Off course gatekeeper needs to be off once something doesn't have a valid signature. But SIP protects /System, NVRAM, kext loading and some additional stuff. Not user app signatures. Hence my question.