How was the S4 ever able to obtain root without ever unlocking the bootloader?

So I am finally ready to move on from my beloved S4 but am realizing that a lot of newer phones cannot be rooted due to the fact that at least with Verizon that their rooting methods require you to unlock the bootloader. I was wondering how devices like the S4 were rooted without ever have unlocked the bootloader (at least in the later versions of updates before loki, where it was locked and when I got the phone), and if anyone can pull up sites that have information on the exploits and methods that were used to accomplish this. Thanks

from xda-developers http://ift.tt/2dqKxZT
via IFTTT