macOS can update files protected by SIP without your knowledge of any update taking place, and without the event being recorded in the Install History. Here’s how it happens.