[OnePlus 7 Pro ROMs, Kernels, Recoveries, & Other D] anupritaisno1:
It seems many people think rooting doesn't pose a security risk

Here's the tl;dr: you are insecure merely because you have rooted, rejecting root access in a manager does nothing

The Android platform was built with security in mind. Root was never a design decision and was never a thing. Root on android is very different from a traditional Linux install (which is even worse)

The only supported way to get root access on Android is through adb on userdebug/eng for a shell user. Achieving it requires users to unlock a hidden menu and authorize a device. This is never user facing even on a debugging build (and FYI if you do unlock the hidden developer menu on glassrom and change anything there, do not ask glassrom for support, it is assumed you know what you are doing at that stage and you won't get support unless you factory reset)

But the last paragraph explains clearly that root isn't designed to be given to apps even on debugging builds. Let us look at why

Assuming a release build of android (user) there are no permissive domains. Even the init domain is heavily limited. Let's assume you somehow got root, then you'd need another exploit at that stage to reload the selinux policy to get yourself a permissive domain (which is still easier if you are root, more on this below)

In simpler words, due to how the android sandbox works even if you got root as an app you still wouldn't be able to do a lot. This is because there is no permissive selinux domain that you could transition to at that stage that allowed you to do what you wanted to do. You'd basically have the same level of permissions as the app even when you are root. You couldn't set selinux to permissive even with root

Spoiler content hidden.

Rooting on android is the process of deliberately breaking this security and introducing a permissive domain that allows the user to do whatever they want

Now, the android sandbox has to be secure. It cannot allow an app to leave it. Any escape would be a security vulnerability. Root solutions must implement a way to escape the sandbox. In doing so, they considerably weaken the sandbox just so that apps can ask for root. At that stage there are huge holes throughout android's sandbox already. A lot of things that should never have been accessible are now suddenly accessible to every single program even if it doesn't ask for root. This is extremely dangerous

Now do you see why rooting is such a security risk even if you don't grant root to an app?

We have some people in this community who do get too ahead of themselves and will use this argument:

"You are already insecure because your bootloader is unlocked so root is not a security issue"

This is completely wrong. This is like saying:

"Your house doesn't have a very strong lock so you should not lock your house at all"

In fact this unlocked bootloader argument is a version of the Nirvana fallacy. Have a read https://en.m.wikipedia.org/wiki/Nirvana_fallacy

Note that the opposite of this argument is simply untrue. Locking your bootloader with root is utterly useless. The whole point of a locked bootloader is to prevent malware from modifying persistent system files to gain root. Please take a moment to understand that is exactly what you have already done, maybe in a non malicious way. At that stage the bootloader doesn't protect you from anything