Most well-designed cleanup tools avoid the SIP-protected scope and operate only on user-writable directories or model and configuration files under /Library.