I would have thought a rooted Android or Ubuntu phone would more secure (done right).
Given that rooting an Android phone frequently involves turning off security features (for example, rooting a Nexus device entails unlocking the bootloader to accept an unsigned boot image), you're probably better off running a stock, unrooted firmware to make it easier to tell if things have been modified. That's in addition to the added attack surface that the root itself provides once the phone's up and running. Y…
Some security settings that pertain particularly to Android devices only (such as ADB, internal SSH server) can only be disabled if you use apps that require root [0]. Maybe if you assume you have a targeted attacker, and they have physical access, root seems like a very bad target. If you install malware that gains root access, doubly so. But if the user is intelligent enough to not install random, non-vetted apps, and to turn auto-updates off, then rooting may actually provide a security benefit here, because you can at least avoid blind network attacks.
I'll also say that if you choose to unroot after using SecDroid [0], then you may find it difficult if not impossible to root the phone again, as you won't be able to use ADB anymore. In any case, there's a lot of vulnerabilities in mobile phones, and you really have to pick and choose to see which ones you think will most likely affect you.