Watching LPC 2020, Android 12 is going to ship with GKIs (Generic Kernel Image), making interesting implications for Android security. Just like iOS, security researchers can focus on a single kernel across all Android devices. This makes exploit based root much more practical.
This could be the next step forward for the Android rooting ecosystem as no bootloader unlock would be required. This basically makes all the recent SafetyNet changes useless, and since we comprise the kernel, no easy detection can work when we root with vulnerabilities.
However, I would say most interesting vulnerabilities might not be in the core Linux kernel itself. Most likely they will exist in vender specific modules. So I still think userspace root (such as Magisk) will still be mainstream going into the future.
Another interesting direction might be towards a custom GKI with root capability included. This may also open up the gates for emulating full TEE in kernel so we can bypass bootloader status checks.
