One of the first steps when rooting is usually to block outgoing and incoming in iptables (it's a fairly standard ubuntu install after all) so you don't lose root at any point, so the risk is minimal. Not to mention I have a dedicated non internet routable IOT network specifically for this reason.