This isn't a theoretical concern, there are known-in-the-wild cases of private and state actors using these device exploits to compromise their users on a mass

This isn't a theoretical concern, there are known-in-the-wild cases of private and state actors using these device exploits to compromise their users on a mass scale. There are many ways to weigh this tradeoff, but just in pure numbers there may be more people with devices that have been compromised without their unforced consent than people who intentionally root them. IMO better to trust in legal processes like Software Freedom Conservancy's lawsuit mentioned above to legally enforce the ability for users to root them than to intentionally leave users vulnerable to exploitation through their devices.