Can adb backup/restore be used to root a device?
Your assumption that the process which writes the restored files to the storage device runs with "quite high permissions" is wrong. Backup service calls backup agents (implemented by applications themselves) to backup and restore data. So each app backs up and restores its own backup data.