Indeed, though I have yet to meet somebody that “doesn’t know what he’s doing” in matters of rooting. Basically, the phones that are still the easiest to bootload unlock are usually only appealing to tech geeks, while the most mainstream phones have a much more complex and hacky (if at all possible) process to unlock. So that in itself filters a lot of tech non-savvy users from getting into the subject…
I’m not sure I agree though with "as anything with root access is unbounded by the usual android permission system, and can completely demolish your OS”. Android’s permission system is imho garbage. It may on paper tick the “provides user with permission management” but since apps that are ill-intended will usually 1) drown the layperson in a multitude of permission requests to do anything, it will usually translate to the user blanket accepting everything defying fine permission management as a whole 2) finer ID / privacy related data acces permissions don’t even get prompted for access, and only rely on the completely broken dev declarative scheme on the play store. IMHO, the finer permission management solutions that the Android community came up with ages ago (well before Android/Apple even thought fo implementing any permission management) did a much better job.
Rooting comes with a root manager (magisk, superUser…) that modal-prompts the user for either permanent or one-time allow / deny access when an app requests root that can be secured by fingerprint/password. I’d argue Root managers are more user-stupidity-proof thant Android’s own permission manager.
As for malicious apps requesting rooting, well, in the end, if the user is 1) stupid enough to download such apps (I’m guessing shady warez / cheat enabled games for the masses) 2) even stupider to accept a root access request from such an app… let natural selection do its job.
Magisk (latest release) + Universel SafetyNet Fix v2.4.0-MOD_1.2 (kdrag0n github) + add the apps to the zygist deny list + rename magisk manager. → does the job for me.