The OIC, if I understand correctly, is an Apple vetted OIK which is created on-device.
This mainly would come into play, as the article says, if you install another operating system. By default, the OS is in Full Security mode, so it would contact Apple when installing the other OS and the OIC may come into play.
But if you aren’t installing another OS, or you set your Mac to permissive security which needs no internet, perhaps the OIC is not required because you’ve downgraded the security?
Im just speculating.
Still, somehow, the fact remains you can fully set up an M1 Mac without internet. The technicals of how it does this while reconciling that with the security guide is unknown.
There are three levels of M1 security, Full, Reduced, and Permissive. You can downgrade at any time without internet, but you cannot re-enter Full without contacting Apple over the internet.
You need to log into 1TR with a local admin account, which is used to prevent thieves from wiping the drive and reselling. This process apparently works even if macOS is damaged, meaning your account credentials are likely stored in the enclave which is persistent and has storage inside the chip.
"One True Recovery". It's a special recovery environment that the user enters when they hold down the power button on an M1 Mac. It looks identical to a standard recovery environment, but it allows you to do things turn off secure boot.
This mainly would come into play, as the article says, if you install another operating system. By default, the OS is in Full Security mode, so it would contact Apple when installing the other OS and the OIC may come into play.
But if you aren’t installing another OS, or you set your Mac to permissive security which needs no internet, perhaps the OIC is not required because you’ve downgraded the security?
Im just speculating.
Still, somehow, the fact remains you can fully set up an M1 Mac without internet. The technicals of how it does this while reconciling that with the security guide is unknown.