Endpoint Security Extension removal by root

Is this always possible using systemextensionsctl by root? Is there a way to prevent root from removing an Endpoint Security Extension? The use case is for a Mac managed by AirWatch.

Endpoint Security Extension removal by root
 
 
Q