Android Isn't Android
Android rooting is tough to fix due to the nature of Android. Because Android is open source, each manufacturer (Samsung, Motorola, Nokia, etc) takes the base Android OS and modifies it:
- Drivers to work with specific hardware
- Custom messaging, call, or system apps
- GUI changes to make their phones unique
- System backup mechanisms
Then the manufacturer gives it to the Vendor (Spring, Verizon, T-Mobile, etc), and the vendor will make their modifications:
- Voice mail
- Other backup mechanisms
- Over the air update services
By the time you get your phone the original Android OS is twisted into something, almost entirely different than Android. Take a friend's phone from a different network or provider. I guarantee the Settings app is different, and there are different GUI changes to it.
So how does this affect rooting? Every time Android is added to introduces new attack vectors for vulnerabilities. If you look up "How to Root Android" you'll find that not every phone is supported by every rooting procedure. And by "supported" they mean "vulnerable". A Samsung Galaxy S3 might be rooted with one program, and a Motorola Razr is rooted with another.
Some root exploits work across platforms, some work across Android versions (each version of Android that's released adds new attack vectors). The Android team most likely fixes root vulnerabilities (this is speculation). But do those changes get propagated to the manufacturer and/or vendor? The manufacturer adds so much driver and GUI code that if a vulnerability is found at that level there's nothing the Android team can do about it. It would be up to Samsung, for example, to fix it. Then it would have to push the patch to each Vendor. It could be a year before the users see the patch, and by then most people have new phones with new software.
Rinse and repeat.
Now too be clear, I'm sure that when Android pushes out a security patch the vendors and manufacturers take it seriously. Those changes most likely make it in to their final build. The point I'm trying to make is that there is not a lot of transparency between these stages, and I don't know for sure what actually happens for a patch/version release.
Universal Rooting Procedure for Nexus 7 and Motorola Razr HD by XDA Developers. Notice how this "Universal" procedure only applies to two devices?