It's a question of whether they would ever get subpoenaed really, and then whether they'd comply. I'm not sure it's worth it from the copyright holders' perspective. The individual users are getting DDL links, so they're not uploading – i.e. "sharing" – anything. These days, if holders go after anyone, it's for the sharing not the downloading. As for compliance, I don't think we have any evidence one way or the other, as (afaik) they are yet to be subpoenaed (despite running for a long time).
It's also worth noting if you do want to do this totally privately: when you buy an RD subscription, you cannot use a VPN during that process (they block known IPs). So, you would want to use a public WiFi connection somewhere, and choose an anonymous payment method like paysafecard.
For as long as Magisk has been going, that's been my root strategy. I'm new to hearing about KernelSU though. Any advantages?