holy shit I got a free NordVPN subscription and their macOS client installs an endpoint kernel extension that just hangs around after an uninstall. There was a constant com.nordvpn.macos.Shield process.

I had to boot into recovery and disable SIP to get rid of it. Part of that is on macOS that it allows to install extensions but systemextensionsctl can't uninstall them.

But still, this is malware-grade behavior; especially given how sketch they are in general.

https://www.reddit.com/r/MacOS/comments/142cv0n/how_to_remove_stubborn_systemextensions_not/