There is an API for backing up all app data that requires authorization. This is different from giving the user root, so any malicious can back up all app data at any time.