There is an API for backing up all app data that requires authorization. This is different from giving the user root, so any malicious can back up all app data at any time.
Oh, that useless thing. I was very confused about something which can "app data that requires authorization" (thought maybe it's some Google service that extracts your secrets for device migrations) but you just mean the old adb backup that the security industry (that I'm part of, and fighting from within :p) destroyed in the name of people's own good
Like, yes this exists, but it doesn't back up half the things you need :(