You can actually do the first bullet point with software like iExplorer - the app sandboxes are only protected on the device, but when connected to your computer it's all available to you.
Could you go as far as messing with the carrier bundles? I had a problem a while ago where Safari would reinstall the carrier's default bookmarks every time it reopened. To be fair it was irritating, not critical, but I was able to hack the carrier bundle and remove the bookmarks, plus change the carrier name out of spite.
Stuff like that, it doesn't change my life but it makes me mildly happier, all because I can get at the filesystem and have root on my own devices.
