That's what I refer to when I say about "gate slightly ajar". The thing is, you only unlock the bootloader that boots the main OS kernel, on EL1. There are more higher-privileged exception levels in an ARM CPU, and Google makes use of those to implement anti-consumer features like the dreaded SafetyNet or DRM. Your main OS is considered "untrusted", and you never get to run any custom code with highest possible privileges, a.k.a TrustZone — only Google and phone manufacturer do. Magisk is a dirty hack which will stop working whenever Google feels like flipping the switch to make use of their TrustZone firmware.