With root privilege, a malware app can certainly do heavy damage, but it doesn't work like that.
Just because an app is on a rooted device, it doesn't mean it gets root privilege automatically. With modern rooting standards, you'll have to permit it. When an app requests root access, a pop-up from SuperUser or SuperSU app appears asking to allow it or not. If you don't know much about the app, simply block access. If you don't pay attention to this, you deserve to experience bad things.
As a last line of defense, I'd like to add that nobody knows from where nasty malware apps can exploit a loophole. You find un-rooted devices secure, but there're apps which are able to even root a device from inside (There was a positive-purpose app named
Root Exploit in Google Market which was later kicked out by Google). So, if you want to be secure, don't install unknown apps. And, if possible, use Play Store only. These suggestions are irrespective of your device is rooted or not.