SIP is simply a restricted flag ACL stored in the file system metadata, so the code require to prevent all writes would be fairly transparent to implement and all other packages would just get an enoperm error if my suspicions are correct. 

You are correct that we don't have a source dump yet for 10.11 so I reserve the right to be totally wrong about my suspicions.