@AphoticDev
Unless Google opens it up in revenge, then no, not totally unprotected. But they did set the rooting path to expand the attack surface needlessly.
It's a consequence of locking up your device, so you can't control it to serve as a vehicle for ads, DRM, and data mining.
Security 3rd, otherwise there would be no problems with patching.