Avoiding having SIP permanently disabled to permit kernel extension
You can selectively enable parts of System Integrity Protection.
For example, you can enable all of SIP except kernel extension protection with
csrutil enable --without kext

Some other options to try listed in https://developer.apple.com/forums/thread/17452, but the kext option sounds the most promising.