When we root, it's because somebody has found an "exploit" -- which can be used for good or bad. We use it for good, to root our phones so we can be in total control. But phone manufacturers/carriers don't like that because they like to be in total control of our phones.
But, some malware writers can use a root exploit to infect your phone.
So, when manufacturers give updates, they also (usually) also block whatever latest exploits they know about -- which stops people from rooting their phones until another exploit is found.
How long does it take to find an exploit? it's found when it's found. No OS is perfect, so there's something there somewhere, but how many people are looking, how much time are they spending on it? They may have other priorities.
