Correct. Even for the not rooted phones, attackers can send SMS, record audio or access SD card due to the permissions the target app applied. Also you may exploit some privilege escalation vulnerability on Android after you got a shell. It's phone-specific and app-specific though.
It flashes saying that the bing App got root permission. I think that's disabled unless the phone was jailbroken.