To what extent is system integrity protection affected if the attacker knows your Mac account password?
SIP itself is not an issue, since that requires physical presence to disable (to wit: rebooting the machine into recovery mode and running a terminal command). At no point during the process of changing SIP settings is your account password required.

However, there's an old adage in computer security: If someone has physical access to your computer, it isn't your computer anymore. 

If a remote hacker has your account password, they could access various network services if they can reach the ports, get an SSH shell, impersonate you, and so forth.

If a hacker sitting in front of your keyboard has your account password, the hacker having your account password is the least of your worries.