Not sure what you mean by “if I don’t have a device”? Also I meant malicious apps moreso than malicious devices. If you have root access then if a malicious app gets control there’s basically no restrictions on what it can do given root access.

Also as far as plain hacking the phone, not through a bad app but through an external device. Pegasus (although probably an unlikely scenario for the average person) can basically hack any smartphone, with the exception of grapheneOS (there were some leaked slides from a meeting a while back that essentially confirmed this).

You say “make things stronger”, well sandboxing and improved permissions access do make for stronger, more contained systems, and grapheneOS improves on both of those. Root access basically provides a sledgehammer to all of that