It may be intrinsically hard. The one time I installed Cyanogenmod, I rooted the phone thanks to a misconfiguration resulting in local privilege escalation. Now, if only the phone manufacturer or the carrier cared to close this vuln with an OTA... Cyanogen could find themselves in a security arms race, where they are the attackers. I don't even know if that wouldn't make it illegal to sell their kits in some countries.