Security implications of remote (Meterpreter) shell to device
That's right. An attacker can only create a shell with this tools/exploits. But if kernel has a vulnerability like privileges escalation, he (attacker) can gain root access then. (This  only exists when kernel has a vulnerability. This is so important.)

But  maybe attacker can execute malicious code with shell/interpreter then gain root access. Something like localroot.  Exactly what you said :


  So the only way to escape from the sandbox would be to tamper the
  app's memory and make use of another exploit, that leads to privilege
  escalation, right? Therefore the impact of such an attack would be
  very limited.


your question = your anwser