Only if I grant them root, which I'd only do to a very small number of open source apps

I instead have to use my desktop web browser, and desktop operating systems have a far worse security model than Android. No special permissions are generally needed to capture the screen, capture/inject keystrokes, or open .mozilla/whatever/cookies.sqlite

So my phone is still the significantly more secure environment. The fact that I have the ability to grant root does not make it "compromised"