> You are expecting and hoping that it will act the same as desktop environments do.

Pretty much.

> Desktop environments can't/don't because there is an inherent expectation of users that they should work a certain way

Yes, and many of those expectations are exactly how computers are supposed to behave in general.

> and they are built upon decades of neglectful security practices.

That is true, but:

> Mobile OSes are the attempt to change that and provide better security models from the ground up

I strongly disagree with unqualified "better" here. Better for whom is what matters, and mobile OSes are security-maxxing in the direction that's - IMO - bad for users. They're optimizing for market ecosystem.

> AOSP being open-source is what gives you the actual control to modify your platform as you see fit, not having runtime root access exposed to the user.

That I vehemently disagree with, in two dimensions:

- Open-source as panacea to everything is a bullshit belief techies overindex on. OSS has long been defeated, SaaS killed it. Whether code is open source or not is immaterial, what matters whether this particular code executing on this particular machine I use is open to me, which is not - and I can't even guarantee it's the same code that's supposedly "open" on some repository somewhere.

- "having runtime root access exposed to the user" is precisely what freedom of computing means. That is the one thing that matters.

> If you expose root access in that way, you have a much lower guarantee that the rules and permissions that you set are going to be able to be enforced by the system, because you have allowed the system to be modified. If something malicious gains that access, you have lost that guarantee.

Wrong. I have a much higher guarantee, because the alternative is that I cannot set any rules at all. Per basic math, "very little" is still greater than 0.