PSA: If you have a 2016 you may want to re-enable SIP.

[Chupa Chupa]

This may have been posted here before but worth repeating. For whatever reason some 2016 MBPs ship with the System Integrity Protection switched off. Normally this is "on" by default. A future s/w update should fix this but why wait? It literally takes a few minutes from start to finish to do this.

How to check to see if it's enabled on your and if not how to enable:

1. Launch Terminal on your Mac
2. Type in “csrutil status”

From there you will get one of two messages saying it’s either enabled or disabled. Should you find that the result turns back the disabled result you can turn it back on, although it does requires booting your Mac into Recovery mode and using the Terminal. Before tinkering around with any settings it’s recommended you have a recent back-up just in case.

1. Boot to Recovery OS by restarting your machine and holding down the Command and R keys at startup
2. From the Utilities menu launch Terminal
3. Enter in “csrutil enable”

Also here is the entire article which also explains what SIP is and does.