Rooting a device doesn't immediately expose you to risk, you must manually allow that. There's very little malware around if you stick to the standard app stores like most users will too. Ads that push malware - a major problem on Windows - practically don't exist on mobile because the impact would be so small. Especially if they're trying to target only rooted users.

Phones don't seem to be very popular attack vectors and many main attack methods could be performed without the need to root the device at all.

All in all, I'd be very surprised if rooting a device ever resulted in a significant compromise which couldn't have been done without root. Exploitation excluded obviously.