I think it's not that simple. It depends on your personal preferences and your threat model.
In my case I have my phone rooted because it makes it very easy to debug some things and reverse engineer some IoT devices. It can also helps you increasing performance in some low quality phones.
It doesn't necessarily open up another attack vector if you are careful and verify for yourself what you install and what you give permissions to. It's like your personal linux computer in which normally you have root access and if you are careful enough it's not unwanted that you have root permissions.
I think it's not that simple. It depends on your personal preferences and your threat model.
In my case I have my phone rooted because it makes it very easy to debug some things and reverse engineer some IoT devices. It can also helps you increasing performance in some low quality phones.
It doesn't necessarily open up another attack vector if you are careful and verify for yourself what you install and what you give permissions to. It's like your personal linux computer in which normally you have root access and if you are careful enough it's not unwanted that you have root permissions.