On most (if not all), the "firmware" is under the /system partition. That partition is mounted as read-only. You need root to remount it as r/w.
AFAIK, rooting exploits in the past took advantage of buffer overflows and remote code exploits to execute code at a raised privilege levels. Now a days, that's also difficult since past vulnerabilities have been fixed and the proliferation of SE Linux.
As a corollary question, does anyone use Tiling Window Managers on Windows? Is the one you use good?
I've been using bug.n[1], but my experience has been subpar due to it's bugginess (namely due to applications such as various terminal applications such as cmd/Console2/cmder refusing to re-size themselves properly).
It'd be really cool if one of these websites integrated with Amazon S3 (i.e. download it and store in one of my buckets). I don't need the storage, just the bandwidth.
It's a lot easier for things to "just work" when one company controls the entire stack.
That being said, as others have pointed out, ChromeCast and Miracast solve different problems. One is something more of a Wireless DLNA solution while the other is real-time streaming.
Some lower end SoCs just do it in the DSP.