Good clues! But not solved yet.
Background: I had already run the norton extensive instructions and script from zip here:
https://support.norton.com/sp/en/us/home/current/solutions/kb20080427024142ENThe script (run twice to double check) claimed to have scrubbed my system.
But kextstat | grep -i symantec revealed this:
com.symantec.SymXIPS (9.0.1)
com.symantec.internetSecurity.kext (9.0.6)
com.symantec.nfm.kext (9.0.2)
com.symantec.ips.kext (9.0.5)
kextunload -b on items 1,2, and 4 yields a complaint e.g.
> sudo kextunload -b com.symantec.SymXIPS
Failed to unload com.symantec.SymXIPS - (libkern/kext) kext is in use or retained (cannot unload).
kextunload -b com.symantec.nfm.kext causes Mac to crash immediately with a multilingual black screen helpfully explaining it will restart automatically in a few seconds.
Norton is not letting go easily.
I finally found these kext files in /Library/StagedExtensions/Library/Extensions
I'm about to reboot and attempt csrutil disable to get at them.