OTA, as of right now, needs to hash the device to prevent system corruption. I don't think it's a very simple problem to solve, or surely there would be a ROM out there that does fix it with root. A better fix would be a package manager, but that's not going to happen with AOSP.

Regarding #1, it's fundamental to AOSP, and not any particular ROM. Similar to the OTA issue above. It's not just graphene (which, technically, you can root fyi, but I really would not do so, as again it defeats the purpose of running a verified boot secured phone).

#2 is debatable, because it's also highly dependent on the distro and configuration. As an example, immutable distros (which are actually closer to Android than non-immutable distros) make it so sudo/root isn't needed very often, if at all. Fedora CoreOS, for example, can run package updates on a schedule without user intervention, use rootless containers, and do verified boot. It can be deployed from a single file and validate itself after the fact, meaning a user would never be prompted for a password at any point. Obviously that's not a 1:1 because it isn't made for PC usage, but other distros based on Fedora Silverblue and the like can be more secure than standard Linux for similar reasons. Everything is generally sandboxed (flatpaks and containers) and root is rarely, if ever, required.

That being said, if you're not concerned, there isn't anything stopping you aside from your phone's manufacturer, which I'm sure you're aware of. I'm fine just knowing that I could do it, and much prefer the security benefits of verified boot and proper sandboxing above all else. I don't trust Google to properly patch zero days related to rooted phones, let alone patch the ones that affected non rooted devices.