You don't need access to the full code of the OS, just enough to write kernel drivers. Once your code is running at ring0, you can rootkit away. I wonder how similar iPhone kernel development is compared to Mac OSX?
I think Apple actually customizes the firmware packages for each carrier since they maintain separate versions for ATT/Verizon for each iPhone model...
I don't even have an iPhone nowadays, I'm just curious. :)