[Google Pixel 7 Pro] JW09I4:
Information Security and Privacy:

The ability to configure a firewall [AFWall+] and use a custom hosts file to block adverts, malware, and phishing sites without relying on a third-party app to do so (Magisk's system-less hosts uses the MVPS hosts file)

Many apps have no business connecting to the internet and the ability to firewall apps would prevent many of the data leaks and malware infections caused by apps (e.g. an app can't communicate with a C&C server if it has no Internet access)

What seems to be at play is by not allowing a user outright to have admin privileges on their device, it prevents firewalling app internet access to obstruct the data being procured for advert purposes from being procured (the amount of internet connections being made by apps not being used is massive and can be seen by logging the traffic in AFWall+) - this is why Android is free after all, we're the product being sold

Backing Up and Restoring Data:

In order to capture and restore a complete backup of user and app data, root permissions are required

Non-UI Customizations:

The ability to disable individual app receivers via apps like AutoRun Manager, as well as freezing unwanted system apps to keep them from running in the background - for example:

For users with Verizon Wireless, disabling a specific receiver for the My VZW app prevents the app from taking control when dialing 611

Disabling firebase receivers disables developer analytics for an app

Some apps have two or more boot receivers, and simply disabling them from running at boot doesn't always disable them if they have more than one boot receiver

Ability to move SSL certs from user to system (such as those for SSL VPNs)

UI Customizations:

some UI customizations require root permissions

Enable Zygisk in Magisk and configure the DenyList to prevent specific apps from detecting root:

Magisk Settings → Magisk → Enable: Zygisk and Enforce DenyList → Configure DenyList

Some banking apps may be able to still detect root upon choosing to configure biometric login - if this occurs, ensure all receivers for the app are enabled in the DenyList by tapping on the app name in the list, else skipping the biometric enrollment for those specific apps may be the fix (delete app storage prior to re-opening app if this occurs)

Enable system-less hosts in Magisk's settings, which uses the MVPS hosts file to block advert, malware, and phishing domains

See reply to trainfire's

This is default for Android, regardless of flavor AFAIK

For the average person, no risk at all (all rooting does is give the user admin privileges within the OS when those permissions are requested) - anyone stating otherwise would need to explain their logic since it's no different than using a BSD/Linux distro on a PC/Laptop and using sudo to gain root privileges for mundane things like installing software via apt || apt-get, or for a whole host of other things

Imagine for a moment the ludicrousness of a PC/laptop manufacturer preventing the buyer from accessing the admin account for the OS the computer is shipped with - yet consumers rarely, if ever, choose to confront their legislatures with this apples to apples comparison (PCs and many laptops both support cellular radios - it's a literal apples to apples comparison; even routers often come with a SIM card slot on the motherboard for using it with a cellular data plan)

What seems to be at play is by not allowing a user outright to have admin privileges on their device, it prevents firewalling app internet access to obstruct the data being procured for advert purposes from being procured (the amount of internet connections being made by apps not being used is massive and can be seen by logging the traffic in AFWall+)

For users who like to tinker with hardware performance values, that can result in hardbricking a device if a mistake is made, however this isn't what or why the vast majority root their devices