A rootkit can be a backdoor - Is this statement correct?

Regarding this sentence - A rootkit can be a backdoor

A rootkit is a set of tools that you run on a target machine when you somehow gained access to it with root-level privileges. The point of the rootkit is to transform that transient access into an always-open door.

• First, let's see how this fits with your points:
  
• Is a piece of code written by the attacker and injected in a system.
  

"Injected into a system" is pretty broad, but accurate. It doesn't need to have been written by this attacker, though; they could've gotten one off-the-shelf, especially if it's using a common tool (like openssh) to keep the elevated privileges.

Allow the access into the the system only to the user that wrote the code, or at least has knowledge of the code A rootkit allows an unauthorised user to gain root privileges if they know "the secret handshake" (whatever the trigger is for the rootkit). Authorised users (for instance, sysadmins) are still able to do the things they normally do. And another attacker doesn't need to know the specifics of the rootkit implementation, just the details of how to get it to work (the user interface, shall we say). A good example of this distinction is the Sony copy protection rootkit, which hid any process that matched a certain name pattern and was used by several unrelated pieces of malware.

Are hard to detect and to patch Generally, yes, since the attacker has root access and all of the privileges that come with it. A backdoor is a much more generic term, referring generally to some sort of way for an unauthorised user to gain access to a system. The name comes from the physical world, where you might have the front door to a building guarded, but a little-known back door that is unguarded (or more loosely guarded).

I suppose that a rootkit is a sub-type of a backdoor; the specific access it gives is persistent root access on a Unix-like system. However, backdoors can cover a much wider area. One of the most common associations with backdoors is disgruntled former employees. Imagine that you had a developer working at your company on some sort of web app that has an administrative panel. Normally, the panel requires a valid username and password to access. However, this developer secretly added code that allows them to double-click in the top-left corner and bypass the login screen. This would be a back door (given access that they should not), but is not a rootkit (there's no root account here).