>A rooted system can present itself to a process to look like a non-rooted system if it's engineered well enough.

That was true 20 years ago, but most smartphones these days have cryptograhically-verified boot chains and remote attestation of how the boot went.