People running Nexuses have root on their smartphone, even better, they can replace the copy of android with a modified one (which is really what you want, not people running around with /sbin/su in their smartphone). Granted, there are blob everywhere and running a more recent kernel is hard (impossible?), and there isn't a sensible mechanism like secureboot on x86 to add the users key to the bootloader, but it's not that bad a situation. The problem is the rest of the Android ecosystem, and Microsoft phones, and of course Apple.

Besides, if free software can't provide security, people won't run free software. End of story.