The malicious app also needs to be undetected by Google. So it cannot use a root method detected by Play Services apk analyser. It is definitely doable .. b

The malicious app also needs to be undetected by Google. So it cannot use a root method detected by Play Services apk analyser. It is definitely doable .. but yeah, not really a credible threat at scale.