So let's circle back to the original question.

Pwning the app will only provide access to whatever permission it has and we are still sandboxed.

Pwning a kernel module\driver will provide access to everything whether its messaging, call logs, pictures etc. we are not sandboxed, we don't need an LPE exploit.

I think the priority is clear.