macOS can update files protected by SIP without your knowledge of any update taking place, and without the event being recorded in the Install History. Here’s how it happens.
StorageKit
Troubled at times, we have used Disk Utility through thick and thin. Now it has changed to support APFS, with some weird behaviour.
The Eclectic Light Company 