Yes, all of this requires a rooted phone or otherwise subverting the Android security model.

A potential alternative could be finding an ancient APK that didn't have the 'prevent backup' bit set, downgrading via adb install, and pulling an adb backup. Still, massive PITA.