Some of those other interesting permissions are the ability to open arbitrary network/bluetooth sockets, read/write to external storage, and access the camera[1].

Mediaserver is not full root but it is pretty privileged. Given all of this access it wouldn't take much work to incorporate another privilege escalation bug to get root on the phone anyway, and there is zero user interaction.

[1] https://www.blackhat.com/docs/us-15/materials/us-15-Drake-St...