If you have a rooted phone, download malware, and hit the allow button to give the malware root access, then it can do whatever it wants.

If you have a nominally unrooted phone on an old Android version and download malware, it can exploit a kernel bug and give itself root access and do whatever it wants.

Protecting against the first case and not the second is at best security theater.