How a few legitimate app developers threaten the entire Android userbase (Ars Technica)

It's true that there would be no need for packaged root exploits, but there should be none regardless of the security situation, because the vendor should respect our freedom to use root capabilities anyway.

Also the risk is not entailed by the fact that the exploits exist in the form of packaged root exploits. The risk is entailed by the fact that these security vulnerabilites exist and, more importantly, are not fixed by the vendor because he sells a locked down product, which doesn't receive any further support after ~18 months, depending on the purely arbitrary decisions of the vendor. In PC world this would be a joke, if Apple or Lenovo would sell laptops, whose OS could not be updated after less than 2 years, these OEMs would fade into irrelevance.