Plot twist: could a rooted device be actually safer than a non-rooted one?
You misunderstand the logic of su binary.

Android doesn't have an su command like other Linux distros do. The su binaries we use on Android are added to the /system (for pre-6.0 versions) and they are customized to work with the GUI application (such as SuperSU)

So when you run an application that wants to run as root, it sends out a call to su binary. Binary checks the list generated by the GUI app to see if you have a preset choice for the application such as allow, deny or prompt. If you don't have a preset choice for that specific app then it checks your default choice and acts accordingly.

There isn't one universally accepted su binary. Any developer that develops apps like SuperSU or Superuser (GUI apps) crafts their own su binary in a way that it'll work with the GUI app.

So if a malware flashes its own su binary, it will be customized in a way that it won't ask or notify you in any way whether you are rooted before that or not.

You can check my other answers from here, here and here for extra information about root systematics of Android.