In the cast that malware and/or a trojan has infected macOS, can an attacker disable system integrity protection and inject code and do other harmful stuff? Can an attacker even discover your admin password before disabling sip as keylogging software would be needed? If he can't discover the password that way then lets say he guesses it because the passcode is really simple.
SIP itself is not an issue, since that requires physical presence to disable (to wit: rebooting the machine into recovery mode and running a terminal command). At no point during the process of changing SIP settings is your account password required.
However, there's an old adage in computer security: If someone has physical access to your computer, it isn't your computer anymore.
If a remote hacker has your account password, they could access various network services if they can reach the ports, get an SSH shell, impersonate you, and so forth.
If a hacker sitting in front of your keyboard has your account password, the hacker having your account password is the least of your worries.