If a rouge app had root access, it could install a completely undetectable rootkit on the phone. That's why root access is very dangerous -- it means literally unrestricted access to everything on the phone, only limited by the hardware and nothing else.