FYI, in Big Sur and later versions of macOS, some system files are very hardened, and hard to attack.
Apple took a bunch of files that the Mac does not need to change during normal operation, and put them into a sealed system volume. The volume is "signed" using a cryptographic key. If malware modifies this volume, the signature will no longer match the contents of the volume, and the Mac will refuse to start up from that volume. Furthermore, the Mac does not run off the sealed system volume – but off a read-only snapshot of it.
Your data, and the parts of macOS that might need to be modified, don't have this extra protection. So malware could still try to, e.g., encrypt all of your documents and hold them for ransom. But the system files in the sealed system volume are just "slightly" hardened against malware attack!
For more gory details than you ever wanted to know (or likely want to know), see: The Eclectic Light Company – Boot volume layout