At the point where you have root you basically won. You can ship user’s data elsewhere. You can install a key logger. You can empty their bank account. But yes

At the point where you have root you basically won. You can ship user’s data elsewhere. You can install a key logger. You can empty their bank account. But yes if the OS also let’s you change the boot ROM then you can make your root access semi-permanent.