> Someone downloading a photo editing app and then having a rootkit installed in the background that waits to empty their bank account is not a workable situation.

Yes, that would be absurd. Thankfully, that isn't how root access has worked in a very very long time if ever. If photo editing app requests root access... you click deny and uninstall it.