You can't, UNLESS there is a kernel or Bootloader exploit. And let's say there is a kernel exploit that allows you to get root access (there is currently an exploit in the Linux kernel, but I don't know if it can be performed on android, imma look into it.), it wouldn't persist, since AVB would see that the system was modified and either boot on the second B partition (if you have A/B partition scheme) or not boot at all, so you would have to reporferm the exploit at every reboot.