Quest 1, all firmwares, Quest 2 and 3 on some non latest hardware, can already be rooted, so that's not the bottleneck.
https://github.com/FreeXR/exploits is a good starting point for that. I think replacing the Android userland would be the tricky part here.
I have few rooted Quests, only some Quest2 still left unrooted.