As already indicated by @Cube in the comment, some (not all) Android phones allow to unlock the bootloader to flash custom kernels and firmware to your device. However, there is only a limited number of models that support it since it is meant for researchers and developers. Also, during the unlocking process you lose all your data, so you cannot use this to silently flash a malicious system or kernel to someone's device without him/her noticing it.
But in general, the bootloader is locked, so this is the one line of defense against getting root: disallowing to flash custom software. As an experimental feature, Android recently also introduced dm-verity to make persistent rootkits even harder.
The other way is to use privilege escalation attacks, meaning you actively exploit a vulnerability in Android that allows you to get root privileges. For example, some services need to run as root, so if you can run code in their context you execute your code with root privileges. However, let's get back to your question about the defenses. First, app's processes are isolated from other processes and the middleware by the kernel. More concretely, Android (ab)uses Linux' user seperation by assigning each app a unique userID. So the kernel isolates them the same way as users are isolated on classical Linux systems. So classical viruses where other programs/apps are infected is simply not possible on Android if there is no critical vulnerability at hand. Also, the middleware contains a lot of access control points where the caller is checked and verified. In addition,
beginning with Android 4 Google started to integrate SELinux into Android as the so called Security Extensions for Android, or SE for Android.
Here, more fine-grained mandatory access control is added to further lower the chance of a successful attack.
When it comes to preventing special kinds of attacks, Android also added support for ASLR in the 4.x versions and extended it ever since then. For example, on newer Android 5 versions binaries are only loaded if they are compiled as position-independent executables.
So this is a subset of all the defenses that Android provides against attacks in general or root exploits in particular. This list is not complete but it gives you an idea what attackers need to overcome and how much the Android devs care about security (which I personally appreciate a lot).