Intercepting calls before they go out through the main dialer, and instead using some form of VoIP.

Intercepting an incoming SMS that's used for phone number verification, rather than requiring that the user switch to their SMS app and manually enter a code.

For that matter, replacing the SMS app with something better.

Reasonable app backgrounding support for any purpose you can think of, not just for those that Apple has graciously allowed you to do.

Hell, you couldn't even have custom keyboards on iOS until recently.

Apps can also have access to stuff that iOS never allows: e.g. I have a 3rd-party app that backs up my SMS database to Google Drive every night. It can also do backups to Dropbox and a couple other services. With iOS your one and only cloud backup solution for "system related things" is iCloud, and you can't change that.

None of these things require rooting the device. Yes, all of these things can be abused. But I prefer permissiveness that requires a little vigilance on my part over living in a restricted environment.