Why is that? To my understanding, apps would still need to expoit security bugs, and the mere existence of them is unrelated to wether you have rooted your phone or not.
Am I understanding this right - dishonest apps have the capability to steal your wallet regardless of whether or not the user has rooted the phone? Why then require the phone to be rooted to back up the wallet? It seems that this requirement has no additional safety benefit, but the negative aspect of making it harder for people to back up their wallets.