Rooting a device with an APK file is definitely possible.
In reality it depends on two factors:
- The age of the device software
- The amount of money you are willing to pay to for exploit software
The device software age is important as usually you can say the older the device the more security vulnerabilities it has and therefore there is a higher chance to get a combination that allows you to root the device.
For example the very old devices can all be rooted using the TowelRoot app (which uses AFAIR an kernel exploit).
The price you are willing to pay for an exploit is important as you can buy exploits (even zero day exploits that are not known to Google or the device manufacturer).
Once a malicious APK has been installed it can use the incorporated exploits to attack your system. Once it managed to find a working exploit to get root it can do anything you could do with root permissions, too. This includes installing code persistently into your system, redirecting traffic, extract passwords and other secrets, ...