The number of choices exposed to users is irrelevant, what's relevant is that choices which I'd want exposed are not exposed, and without root, there's no extension mechanism which'd let me load my code into for example the system server process.

What you also seem to be ignoring is that the fact that for example there's no simple runtime internet permission toggle is NOT an accident, this functionality is deliberately not directly exposed despite creating no "security risks" and you know it very well.