Source?

To say a completely compromised kernel, even if it is read only, can not be further compromised in some currently unforseen way to allow for escalated executions is a bold statement.

Here is a potentially similar situation for Windows. It demonstrates a devastating exploit which stemmed from simple user mode reads. They escaped ring3, ended up executing in ring0 and in turn compromised the system token. Full system access. They can do what every they want.

I wouldn't be surprised if something similar is waiting to be discovered for mobile devices. Bam, now Spectre has a full user mode escape -> ring0 escalation which can "easily" be used to create a root for a phone.

In reality such an exploit isn't going to be wasted on creating a root/jailbreak. It