What Asus broke here was the bootloader unlocking. Without that, there’s no custom ROMs or root. Root and bootloader unlocking mean different things.

Regarding root being a terrible security risk or not, I guess it will depend on the user? I never had any issues and only see it as one more thing that isn’t as safe as it could be… my bootloader is unlocked, the recovery isn’t stock, I’m running a custom ROM so I have to trust the developers/building process, etc.