There's two competing threat models here. The first is that some shady government agency is going to take your phone and try and break into it. This is an issue if you're actually going up against a government in some form. The second is that the phone itself sends stuff across the internet that you don't want sent. Rooting your phone may hinder the first but it's necessary for the second.
How could you verify that these phones run the same setup as regular phones?
The only way to make companies fix bugs which may be difficult to find, expensive to fix, and potentially embarrassing is to make it easy to locate exploits on real hardware. Otherwise the only people with the resources to do this are government-backed entities like NSO Group, Vupen, etc, who somehow always ensure that exploits get into the hands of repressive governments.
Agreed, which is why I shouldn't have to. Give me root of of the box. Print the root password on a card in the packaging. Yes I can undo all the privacy measures if I make mistakes but that is on me.
