What does "rooted" mean?

This can ultimately only be answered by a court. The ambiguity you are highlighting is whether "rooted" means that the device has root access enabled (since the outset) for the user or whether it means that it's had a process of rooting applied to it at a later stage.

Ordinary meaning

One of the ways that courts will try to interpret contractual clauses is to look at the ordinary meaning of the word. Normally the starting point would be to consult a dictionary, but it seems that this use of the word "root" is either too modern or too technical because I couldn't find any online dictionaries that have it. However, Wikipedia says this:

Rooting is the process by which users of Android devices can attain privileged control (known as root access) over various subsystems of the device, usually smartphones and tablets.

Rooting is often performed to overcome limitations that carriers and hardware manufacturers put on some devices. Thus, rooting allows the users to alter or replace system applications and settings, run specialized applications ("apps") that require administrator-level permissions, or perform other operations that are otherwise inaccessible to a normal Android user.

This all implies that "rooted" is something that a user does to the device in order to overcome manufacturer-imposed limitations rather than a state that the device starts with when it is manufactured.

This fits with how most people use the word. For example, I've never heard of a Linux distro being referred to as "rooted" just because it already has root access by default.

Context

Another rule of interpretation that courts can turn to is noscitur a sociis. If a word seems ambiguous, you look to the surrounding words to see if the context helps to narrow down the meaning. For example, in the list "knives, forks, and spoons", it's clear that fork refers to an item of cutlery and not a fork in the road.

Here, we have "compromised, rooted, or jailbroken". Both of the other two words obviously apply to something that is done to the device by the user that enables the device to be used in a way which wasn't intended. In context, the word "rooted" therefore means something similar.

Counter-argument

On the other hand, if we widen the context, the terms and conditions say this:

4. Security Obligations

You agree to:

• Keep your device, passwords, PINs, and biometrics secure.
• Notify us immediately if your device or account is lost, stolen, or compromised.
• Not use Lomalo on any device you know (or should know) has been compromised, rooted, or jailbroken.

From this it's clear that the words are intended to require you to keep your device secure. A device that has root-access enabled by default is arguably the same thing (in terms of security) as one that was rooted later. Lomalo's intention was to require you to use a device that is difficult to compromise. A root-enabled device goes against that.

Which interpretation is correct?

The contra proferentem rule of interpretation says that ambiguities should be resolved in favour of the person who didn't draft the contract. In england-and-wales, if the user is a consumer then Section 69(1) of the Consumer Rights Act 2015 applies a statutory version of this rule:

If a term in a consumer contract, or a consumer notice, could have different meanings, the meaning that is most favourable to the consumer is to prevail.

So, if you can convince the court that there's a genuine ambiguity, then "rooted" should mean something that was done by the user at a later stage.

I think a court would look at the intent and purpose of this clause, which is to ensure that the operation of the Lomalo Digital Wallet application can be trusted. In this context, it doesn't matter how the device came to be compromised. While rooting and jailbreaking are usually actions that the user takes after purchasing a device, the effect is the same if the manufacturer or vendor does it first.

However, it's possible that the vendor might do this covertly, in which case the criterion "you know (or should know)" would not be met, and the user would be innocent. In general, users trust that the devices and software they purchase and/or download act reasonably -- it's difficult to exist in our digital ecosystem if you're overly paranoid.

So unless there's been public disclosure that some devices have been compromised, and that the user could be aware that their device was included, this clause would usually only apply to intentional rooting by the user.

canada

There is no precise legal definition "rooted" (or for that matter, any particular term) in the abstract. The meaning of a term, such as "rooted" will be determined in light of the context, purpose, and the surrounding circumstances of the contract. See Sattva Capital Corp. v. Creston Moly Corp., 2014 SCC 33, paras. 48–58.