Firstly, an application that has obtained administrative rights comes out of the application “sandbox,” so its declared features and granted permissions are no longer relevant. It will be able to do everything it wishes, including reading and sending files associated with other applications, watching the device’s owner, using the microphone without the owner’s knowledge, etc.
Secondly, applications for rooted or jailbroken smartphones are typically created by small amateur groups, so they are very likely to contain sloppy code with its own vulnerabilities. That vulnerability could be exploited by a seemingly-legitimate app, handing over administrative rights of the phone.
Thirdly, a number of changes introduced into the phone’s configuration during rooting/jailbreaking may be a gift for a hacker: jailbreaking makes most iPhone models remotely controllable, since the same password is valid for all devices. Naturally, the password can be changed, but very few users do so.
But I guess you can define more vulnerable however you like when you make statements and say "Period!"
