There is an API for backing up all app data that requires authorization. This is different from giving the user root, so any malicious can back up all app data at any time.
If you control the build, you should implement your own Backup Service. You should not just open all apps' data to any app.
It's easier and more reliable to use adb root to rsync everything. No apps need root access that way.