Even if it's not rooted, your carrier and your device manufacturer effectively have remote root access to your phone and you may not trust either of them.