They're right that in linux, it's stupid to run in root shell all the time due to vulnerabilities.
However who runs linux in root shell? What you do is log in as a standard user and if you install an app, you are prompted for root credentials. This lasts for that package manager or terminal session only and doesn't give root to other areas of the system.
Android is similar in that the superuser app doesn't prompt for a password. But you have to press allow. Something an application can't do.
As with an unrooted android device, all applications are sandboxed. No application can have access to anything unless you allow it. With the superuser app, you have double protection and rightly so.
Root itself is dangerous but we are somewhat protected.
Of course as with non root you still need to be vigilant with applications. Once you allow, its too late. Only allow what you know and understand.
My main issues are:
1-The ability to wipe any tracking software but factory reset does too.
2-if they know what they're doing, even if your phone is locked, they can get all your data.
2 is obviously a very big issue. I'd like see a way to protect recovery and fastboot with a password.
Edit
Also this data can be grabbed out of a nandroid backup too