You have secure chain of boot so you can't launch the malicious stuff on boot. But - this doesn't prevent you once you have root to modify some app and system

You have secure chain of boot so you can't launch the malicious stuff on boot. But - this doesn't prevent you once you have root to modify some app and system settings for the phone to reinfect itself eventually (proxies, vpn, who knows what)